Toptech Systems RCU II+ and Multiload II+ Missing Authentication for Critical Function
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. This vulnerability stems from a network-accessible port running a Target Communications Framework (TCF) service that does not require any authentication, allowing an attacker to directly interact with the Linux environment that powers the device. Once connected, an attacker can freely view and modify the filesystem, manipulate running processes, and control network interfaces, enabling deep alteration of system behavior.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Toptech Systems | RCU II+ | before 2025-11-24 | 2025-11-24 | Patch available | CNA |
| Toptech Systems | Multiload II+ | before 2025-11-24 | 2025-11-24 | Patch available | CNA |
- RCU II+ VendorToptech Systems Affected before 2025-11-24 Fixed in 2025-11-24 Patch available CNA
- Multiload II+ VendorToptech Systems Affected before 2025-11-24 Fixed in 2025-11-24 Patch available CNA
Remediation
- Fix · CNA RCU II+ (Toptech Systems) Fixed in 2025-11-24
- Fix · CNA Multiload II+ (Toptech Systems) Fixed in 2025-11-24
Timeline
- 2026-10-02 Threatist record created from CVE-2026-12562
- 2026-10-03 Alias added: GHSA-w374-9vqx-5hr2
References
Other 6
- https://s3.amazonaws.com/docs.toptech.com/nonpublic/rcuiip_mliip_vrt.zip
- https://s3.amazonaws.com/docs.toptech.com/nonpublic/rcuiip_mliip_vrt.gz
- https://s3.amazonaws.com/docs.toptech.com/index.html#downloads/Firmware/RCUII+_MLII+_SMPII+/
- https://s3.amazonaws.com/docs.toptech.com/nonpublic/2025%2012%2001%20RCU%20IIPlus%20MultiLoad%20IIPlus%20Vulnerability%20Notice.pdf
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-03
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-03.json
More Toptech Systems vulnerabilities
- TI-2026-50020 Toptech TMS7 and TopHAT Files or Directories Accessible to External Parties CVSS 4.0CRITICAL 10.0
- TI-2026-49169 Toptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous Type CVSS 4.0CRITICAL 9.4
- TI-2026-50785 Toptech TMS7 and TopHAT SQL Injection CVSS 4.0HIGH 8.5
- TI-2026-50783 Toptech TMS7 and TopHAT SQL Injection CVSS 4.0HIGH 8.5
- TI-2026-48473 Toptech TMS7 and TopHAT SQL Injection CVSS 4.0HIGH 8.5
- TI-2026-47852 Toptech TMS7 and TopHAT SQL Injection CVSS 4.0HIGH 8.5
Sources
- CVE-2026-12562 · CVE Program
- CVE-2026-12562 · NVD
- FIRST EPSS
- GHSA-w374-9vqx-5hr2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences