Toptech RCU II+ Devices Expose Root Access
Toptech Systems RCU II+ and Multiload II+ fuel management devices run an unauthenticated debug service that grants full root access to the underlying Linux system.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA has published an ICS advisory for Toptech Systems RCU II+ and Multiload II+ units running firmware versions prior to 2025-11-24. The devices expose a Target Communications Framework (TCF) service on the network without any authentication, allowing anyone who can reach the port to interact directly with the underlying Linux environment. This grants an attacker the ability to view and modify the filesystem, manipulate running processes, and control network interfaces — effectively full root-level control of the device.
The flaw is tracked as CVE-2026-12562 and classified under CWE-306 (Missing Authentication for Critical Function). Toptech Systems devices are deployed worldwide in the energy sector, likely as part of fuel dispensing/tank monitoring and load management infrastructure. CISA notes the vulnerability is not remotely exploitable over the internet and there is no known public exploitation at this time, indicating the risk is primarily to adjacent-network attackers rather than opportunistic internet-wide scanning.
Toptech Systems has released Vulnerability Removal Tools (VRT) and updated firmware to remediate affected units, with the VRT option preferred since it avoids breaking Weights and Measures seals. CISA's standard ICS mitigations apply: isolate control system devices from business and internet-facing networks, place them behind firewalls, and use VPNs for any required remote access. The vulnerability was responsibly reported by Donald Green of Southwest Research Institute.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-03
Free public brief. The indicators are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs