Toptech RCU II+ Devices Expose Root Access

Toptech Systems RCU II+ and Multiload II+ fuel management devices run an unauthenticated debug service that grants full root access to the underlying Linux system.

CISA has published an ICS advisory for Toptech Systems RCU II+ and Multiload II+ units running firmware versions prior to 2025-11-24. The devices expose a Target Communications Framework (TCF) service on the network without any authentication, allowing anyone who can reach the port to interact directly with the underlying Linux environment. This grants an attacker the ability to view and modify the filesystem, manipulate running processes, and control network interfaces — effectively full root-level control of the device.

The flaw is tracked as CVE-2026-12562 and classified under CWE-306 (Missing Authentication for Critical Function). Toptech Systems devices are deployed worldwide in the energy sector, likely as part of fuel dispensing/tank monitoring and load management infrastructure. CISA notes the vulnerability is not remotely exploitable over the internet and there is no known public exploitation at this time, indicating the risk is primarily to adjacent-network attackers rather than opportunistic internet-wide scanning.

Toptech Systems has released Vulnerability Removal Tools (VRT) and updated firmware to remediate affected units, with the VRT option preferred since it avoids breaking Weights and Measures seals. CISA's standard ICS mitigations apply: isolate control system devices from business and internet-facing networks, place them behind firewalls, and use VPNs for any required remote access. The vulnerability was responsibly reported by Donald Green of Southwest Research Institute.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-03