The introduction of Web services has significantly increased PLC security risks, potentially leading to severe physical damage. This paper presents PWFuzz, a fuzzer designed to identify vulnerabilities in PLC Web applications that impact physical control. PWFuzz leverages a large language model(LLM) and static firmware analysis to identify test interfaces comprehensively. It employs an automated front-end page and message analysis to extract PLC web functions’ state machines, enhancing test coverage. To avoid local state traps, PWFuzz integrates an energy allocation algorithm and uses LLM-based mutation to generate diverse test cases targeting multiple vulnerability types. To monitor physical control impacts, it combines software monitoring of key PLC services with oscilloscope-based automated hardware monitoring. PWFuzz successfully uncovered 13 previously unknown vulnerabilities in six PLCs from three major manufacturers, five of which directly impacted physical control. These findings demonstrate the effectiveness of PWFuzz. The vulnerabilities have been reported, and one has already been assigned a CNVD ID.