CVE-2021-31886: AI-assisted exploit port targets WAGO controllers

Tracking: CVE-2021-31886
Severity: Critical (CVSS 3.1: 9.8)

Who is affected

WAGO controllers affected by CVE-2021-31886, a Nucleus FTP server flaw. Forescout ported an exploit from a 750-852 to a 750-831 running V01.04.16. CERT@VDE lists affected 750-831 variants at FW14 and earlier; other models have different scope.

How the attack works

The FTP server mishandles the length of the USER command, allowing a stack buffer overflow before authentication. The research demonstrated attacker-supplied ARM code on live hardware, with substantial researcher guidance. A later attempt to extend the payload permanently damaged the test PLC.

This is renewed exploitation research into a 2021 vulnerability. It does not establish an autonomous attack or exploitation of production controllers.

What to do

1. Identify exact WAGO model and firmware versions using CERT@VDE's product matrix.
2. For the listed legacy Nucleus V1 devices without an available update, disable or block FTP on TCP 21 and isolate control networks. The advisory also recommends DHCP and DNS restrictions.
3. Use model-specific remediation: the advisory lists FW10 fixes for a separate device group, while other devices require containment or further vendor guidance. Test changes through operational change control.

Sources

• Original advisory or incident report
• Forescout original exploit-porting research