VulnSocial

CVE-2021-31886PoC(siemens / apogee_modular_building_controller)

CRITICALCVSS 9.8 · CRITICAL

Exploitation observed; activity peaked at 8 mentions and remains active

Immediate actions

  • Patch siemens apogee_modular_building_controller systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.4), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.19), APOGEE PXC Modular (BACnet) (All versions < V3.5.4), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.19), Desigo PXC00-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC00-U (All versions >= V2.3 and < V6.30.016), Desigo PXC001-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC100-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC12-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC128-U (All versions >= V2.3 and < V6.30.016), Desigo PXC200-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC22.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC36.1-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC50-E.D (All versions >= V2.3 and < V6.30.016), Desigo PXC64-U (All versions >= V2.3 and < V6.30.016), Desigo PXM20-E (All versions >= V2.3 and < V6.30.016), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus Source Code (All versions), TALON TC Compact (BACnet) (All versions < V3.5.4), TALON TC Modular (BACnet) (All versions < V3.5.4). FTP server does not properly validate the length of the “USER” command, leading to stack-based buffer overflows. This may result in Denial-of-Service conditions and Remote Code Execution. (FSMD-2021-0010)

siemens CVEsBack to dashboard
8.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-170CWE-787

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • apogee_modular_building_controller
  • apogee_modular_building_controller_firmware
  • apogee_modular_equiment_controller
  • apogee_modular_equiment_controller_firmware

Threat summary

  • Active exploitation appears in 1 classified signals
  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 14 mentions across 5 observed days

What's happening

  • Active exploitation reported across 1 signal
  • Exploit tool or code specified in 6 signals
  • PoC mentioned or linked in 11 signals
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 13 signals
  • Disclosure: 1 classified signal
  • Peaked 3d ago at 8 mentions (2026-09-02); latest day: 1
  • 14 total mentions across 5 days

Affected systems

Vendors
siemens
Products
apogee_modular_building_controllerapogee_modular_building_controller_firmwareapogee_modular_equiment_controllerapogee_modular_equiment_controller_firmwareapogee_pxc_compactapogee_pxc_compact_firmwareapogee_pxc_modularapogee_pxc_modular_firmwaredesigo_pxc00-e.ddesigo_pxc00-e.d_firmware

1 version affected across 41 products

Deep dive

Activity timeline14 mentions / 5d
02468Mentions · 2026-09-01: 2Mentions · 2026-09-02: 8Mentions · 2026-09-04: 2Mentions · 2026-09-08: 1Mentions · 2026-09-11: 1PoC Mentioned / Linked · 2026-09-01: 2PoC Mentioned / Linked · 2026-09-02: 5PoC Mentioned / Linked · 2026-09-04: 2PoC Mentioned / Linked · 2026-09-08: 1PoC Mentioned / Linked · 2026-09-11: 1Exploit Tool / Code · 2026-09-01: 2Exploit Tool / Code · 2026-09-02: 3Exploit Tool / Code · 2026-09-08: 1Active Exploitation · 2026-09-02: 1Patch / Workaround · 2026-09-02: 1Patch / Workaround · 2026-09-04: 1Technical Details · 2026-09-01: 2Technical Details · 2026-09-02: 8Technical Details · 2026-09-04: 1Technical Details · 2026-09-08: 1Technical Details · 2026-09-11: 109-0109-0209-0409-0809-11
Signal classification3 categories
PoC
750.0%
Exploit
642.9%
Disclosure
17.1%
Referenced assets9 URLs
By indicator
Classification over time
DateTotalLabels
2026-09-012
Exploit2
2026-09-028
Disclosure1Exploit3PoC4
2026-09-042
PoC2
2026-09-081
Exploit1
2026-09-111
PoC1
Full discourse14 posts
  • Ryx@PadhiyarRushi
    PoC

    Forescout just showed what AI-assisted ICS exploit work actually looks like right now. They used Claude to port a pre-auth RCE (CVE-2021-31886 in Nucleus FTP) from one WAGO PLC model to another. Result: arbitrary ARM shellcode on a live 750-831 without credentials. It still needed heavy researcher steering, 8+ hours, and ~$535 in API spend. When the agent tried to extend the payload it bricked the device by writing to flash-mapped memory. https://www.forescout.com/blog/can-ai-create-plc-attacks-yes-but-it%E2%80%99s-not-that-easy-yet/ #OTSecurity #ICS #Cybersecurity #Infosec #Trending #AI #Claude #GPT

    Post summary

    The post details a proof‑of‑concept deployment of a pre‑authentication RCE (CVE‑2021‑31886) on a WAGO PLC using AI (Claude), illustrating how the vulnerability can be exploited in a controlled setting but not reporting wild exploitation or a patch.

    10031189
    953 followersView on X
  • DFIR Radar@DFIR_Radar
    Exploit

    AI-assisted exploit porting achieved working RCE on a WAGO 750-831 PLC via CVE-2021-31886, requiring no authentication and executing arbitrary ARM shellcode, but cost $535 in API calls and bricked the device during C2 development. Key findings: - CVE-2021-31886 is a pre-auth buffer overflow in the Nucleus FTP server's USER command handler. Forescout used Claude Opus 4.6 with Ghidra and AI-generated Python scripts to port a working RCE from a WAGO 750-852 to a WAGO 750-831 running firmware V01.04.16, targeting 192.168.2[.]14 in the lab. The exploit sends ICMP and UDP beacons from the PLC with no credentials required on port 21. - The critical technical hurdle was shellcode survival: normal FTP command processing zeroed the 256-byte buffer after the USER command, destroying the payload. The fix was a USER then CWD sequence without a CRLF terminator, bypassing the completion path that cleared the buffer and keeping attacker-controlled memory intact long enough for execution. - Claude also independently flagged a separate potential buffer overflow in the FTP command extraction loop, distinct from CVE-2021-31886, now under separate investigation. - Attempting to extend the RCE into a C2 implant bricked the physical PLC when a payload wrote to flash-mapped memory, illustrating that AI agents acting on cyber-physical systems can cause irreversible hardware damage. #DFIR_Radar

    Post summary

    The post documents an AI-assisted working remote code execution on a WAGO PLC via CVE-2021-31886, specifying the exploitation technique but not reporting wild attacks or a vendor patch.

    11010205
    1.9K followersView on X
  • Bryan@so_sthbryan
    Exploit

    Claude ported a PLC exploit to a different hardware model. Forescout used Claude to adapt a pre auth RCE: - Ported CVE-2021-31886 exploit to new WAGO PLC - Ran attacker shellcode on live hardware AI assisted exploit porting now proven on real PLCs. https://thehackernews.com/2026/09/researchers-use-claude-to-port-pre-auth.html

    Post summary

    The article describes how Claude AI helped researchers port the pre-auth RCE CVE-2021-31886 to a WAGO PLC and run attacker shellcode on a live device, demonstrating a functional exploit.

    00010314
    271 followersView on X
  • ProtAAPP - Protege las AAPP@ProtAAPP
    PoC

    Investigadores de Forescout-Vedere Labs usaron la IA Claude para adaptar un exploit a PLCs WAGO (CVE-2021-31886, CVSS 9.8). Tras gastar 535 € en APIs, CERT@VDE aconseja bloquear el FTP en el puerto 21 y segmentar la red. https://thehackernews.com/2026/09/researchers-use-claude-to-port-pre-auth.html https://t.co/deLmb4UimN

    Post summary

    Researchers used Claude AI to adapt a PoC exploit for WAGO PLCs (CVE‑2021‑31886 CVSS 9.8) and advise blocking FTP port 21 and segmenting the network for mitigation.

    00010281
    8.3K followersView on X
  • Total Cyber-Sec@totalcybersec
    Disclosure

    1/4 🤖 El objetivo fue CVE-2021-31886, un buffer overflow en el servidor FTP Nucleus. #Claude analizó firmware, offsets de memoria y rutas de ejecución hasta ayudar a adaptar el exploit a otro modelo de PLC. #AISecurity

    Post summary

    The text announces CVE‑2021‑31886 as a buffer overflow in the Nucleus FTP server and notes analysis of firmware and memory offsets to adapt an exploit to another PLC model.

    1000064
    15.8K followersView on X
  • Aviatrix Threat Research Center@aviatrixtrc
    Exploit

    TRC analysis shows AI successfully ported a critical PLC exploit across hardware models in 8.5 hours. Researchers used Claude to adapt CVE-2021-31886 RCE for WAGO controllers, achieving shellcode execution and C2 communication before bricking the target device. Runtime segmentation helps contain OT network pivoting from compromised controllers. #CloudSecurity 🔗 Full breakdown: https://aviatrix.ai/threat-research-center/forescout-claude-ai-plc-exploit-cve-2021-31886-wago-controllers

    Post summary

    Researchers showcased a functional exploit of CVE‑2021‑31886 on WAGO PLCs using Claude AI, delivering shellcode and C2 communication, though no evidence of real‑world attacks is presented.

    0001063
    2.0K followersView on X
  • Leonel Marin@LeonelM41262107
    Exploit

    🏭🤖 Investigadores de Forescout usaron IA para adaptar un exploit de un PLC WAGO a otro modelo, ejecutando código sin autenticación (CVE-2021-31886, CVSS 9.8). Sin parche disponible. ✅ Segmenta la red OT 🔗 https://bit.ly/chrysalis-post429 #Ciberseguridad #Chrysalis #SeguridadOT https://t.co/Q1fbNFh8vu

    Post summary

    Researchers used AI to adapt a WAGO PLC exploit to a different model, enabling unauthenticated code execution; no patch is yet available.

    0001030
    28 followersView on X
  • Ryx@PadhiyarRushi
    PoC

    Lab result from today (not science fiction) Forescout Vedere Labs used Claude to port a real PLC RCE (CVE-2021-31886) from one WAGO model to another: 8h 32m, $535.74 in API. Then two working payloads in 12 minutes. Next payload bricked the controller. https://www.securityweek.com/experiment-porting-a-plc-exploit-with-ai-takes-hours-and-hundreds-of-dollars/ #AISecurity #PLC #ICS

    Post summary

    The article showcases how AI was used to port an existing PLC RCE (CVE‑2021‑31886) to a different WAGO model, producing functional payloads that even bricked a controller, highlighting the feasibility of automated exploit adaptation.

    0001054
    573 followersView on X
  • Ryx@PadhiyarRushi
    Exploit

    🔔CVE-2021-31886 | WAGO 750-852 → 750-831 Nucleus FTP pre-auth overflow RCE | AI-ported Forescout + Claude: 8h 32m / $535.74 to port RCE, then 2 working payloads in 12 min; C2 attempt bricked PLC No new CVE, but an old ICS bug, new attacker economics https://www.securityweek.com/experiment-porting-a-plc-exploit-with-ai-takes-hours-and-hundreds-of-dollars/ #OTSecurity #AIRedTeam #PLC

    Post summary

    AI‑assistants ported a known PLC RCE, spending 8 h and $535, and delivered two functional payloads, demonstrating a usable exploit but with no evidence of active wild exploitation.

    00010135
    572 followersView on X
  • セキュリティ対策Lab@securityLab_jp
    PoC

    ClaudeがWAGO PLC向け脆弱性(CVE-2021-31886)を別機種へ移植　Forescoutが実機検証 https://rocket-boys.co.jp/security-measures-lab/claude-wago-cve-2021-31886-forescout/ #セキュリティ対策Lab #security #securitynews #セキュリティ

    Post summary

    Claude ported the CVE‑2021‑31886 exploit to a different device, and Forescout confirmed it works on real hardware, highlighting a working PoC.

    00000133
    625 followersView on X
  • SecureChap@SecureChap
    Exploit

    CVE-2021-31886 is a stack-based buffer overflow in the Nucleus FTP server USER command handler. It hits pre-auth traffic on TCP/21 across WAGO 750-852 and 750-831 devices running Nucleus NET V1 with firmware 16 or earlier, scoring CVSS 9.8. Porting the original exploit meant feeding the source and target firmware details to the model. The key changes were switching from a USER+QUIT pattern to USER+CWD without CRLF termination, recalculating the return address for the new memory layout, and building a payload that sent an ICMP echo reply then a UDP packet containing the string PWNED. A later command-and-control attempt wrote to a flash-mapped region and bricked the PLC. WAGO 750-882 and 750-885/0xx-xxx sit on the vulnerable list yet were left out of the vendor advisory. Nucleus NET stays unpatched because Siemens has stated no remediation is planned for the NUCLEUS:13 flaw.

    Post summary

    The post describes CVE‑2021‑31886, detailing exploit steps and evidence of real‑world exploitation, but provides no PoC or patch information.

    0000087
    170 followersView on X
  • Security Arsenal, LLC@SecurityAr58409
    PoC

    🔒 #CyberSecurity AI-Assisted Exploit Porting Hits OT: Defending WAGO PLCs After Claude Replicate… "Forescout Research – Vedere Labs has demonstrated something every OT defender needs to…" 🔗 https://securityarsenal.com/blog/ai-assisted-exploit-porting-hits-ot-defending-wago-plcs-after-claude-replicated-a-pre-auth-rce-cve-2021-31886 #CyberSecurity #ThreatIntel #critical #zeroday #cve

    Post summary

    A blog post announces that Vedere Labs performed an AI‑assisted porting of an exploit for WAGO PLCs using CVE‑2021‑31886, providing a proof‑of‑concept but no active exploitation evidence, patch details, or exploit code.

    0000044
    30 followersView on X
  • SecNews@SecNews_GR
    PoC

    CVE-2021-31886: Claude μετέφερε RCE exploit σε WAGO PLC https://secn.ws/Zr42xv

    Post summary

    A short tweet announces that an RCE proof‑of‑concept for CVE‑2021‑31886, targeting WAGO PLCs, has been shared via a link.

    0000098
    7.0K followersView on X
  • The Daily Tech Feed@dailytechonx
    PoC

    Danger: Claude AI was used to adapt a pre-auth RCE exploit (CVE-2021-31886) across WAGO PLC models, executing ARM shellcode via USER/CWD commands. Many units are unpatched; firmware fixes lag while risk of AI-enabled OT attacks grows. #AI #IndustrialSecurity #RCE #PLC #Claude #OTSec https://thedailytechfeed.com/researchers-use-claude-ai-to-transfer-pre-auth-rce-exploit-across-plc-models/

    Post summary

    Claude AI was leveraged to adapt a pre‑auth RCE exploit (CVE‑2021‑31886) for WAGO PLCs, enabling ARM shellcode execution via USER/CWD; no patch is mentioned and there is no evidence of active exploitation.

    0000054
    698 followersView on X
CPE platform detail43 entries

43 of 43 entries

PartVendorProductVersionTarget SWTarget HW
HWsiemensapogee_modular_building_controller---
OSsiemensapogee_modular_building_controller_firmware---
HWsiemensapogee_modular_equiment_controller---
OSsiemensapogee_modular_equiment_controller_firmware---
HWsiemensapogee_pxc_compact---
OSsiemensapogee_pxc_compact_firmware---
OSsiemensapogee_pxc_compact_firmware---
HWsiemensapogee_pxc_modular---
OSsiemensapogee_pxc_modular_firmware---
OSsiemensapogee_pxc_modular_firmware---
HWsiemensdesigo_pxc00-e.d---
OSsiemensdesigo_pxc00-e.d_firmware---
HWsiemensdesigo_pxc00-u---
OSsiemensdesigo_pxc00-u_firmware---
HWsiemensdesigo_pxc001-e.d---
OSsiemensdesigo_pxc001-e.d_firmware---
HWsiemensdesigo_pxc100-e.d---
OSsiemensdesigo_pxc100-e.d_firmware---
HWsiemensdesigo_pxc12-e.d---
OSsiemensdesigo_pxc12-e.d_firmware---
HWsiemensdesigo_pxc128-u---
OSsiemensdesigo_pxc128-u_firmware---
HWsiemensdesigo_pxc200-e.d---
OSsiemensdesigo_pxc200-e.d_firmware---
HWsiemensdesigo_pxc22-e.d---
OSsiemensdesigo_pxc22-e.d_firmware---
HWsiemensdesigo_pxc22.1-e.d---
OSsiemensdesigo_pxc22.1-e.d_firmware---
HWsiemensdesigo_pxc36.1-e.d---
OSsiemensdesigo_pxc36.1-e.d_firmware---
HWsiemensdesigo_pxc50-e.d---
OSsiemensdesigo_pxc50-e.d_firmware---
HWsiemensdesigo_pxc64-u---
OSsiemensdesigo_pxc64-u_firmware---
HWsiemensdesigo_pxm20-e---
OSsiemensdesigo_pxm20-e_firmware---
Appsiemensnucleus_net---
Appsiemensnucleus_readystart_v3---
Appsiemensnucleus_source_code---
HWsiemenstalon_tc_compact---
OSsiemenstalon_tc_compact_firmware---
HWsiemenstalon_tc_modular---
OSsiemenstalon_tc_modular_firmware---

Explore more

Back to dashboardsiemens CVEsapogee_modular_building_controller vulnerabilities