Which versions of RCU II+ are affected by CVE-2026-12562?

Toptech Systems RCU II+ and Multiload II+ terminal automation controllers are exposed to unauthenticated remote root compromise through an unprotected debug service, affecting any organization…. A patch is available.

How to fix or mitigate CVE-2026-12562?

Within 24 hours: Conduct a comprehensive inventory of all RCU II+ and Multiload II+ systems in your environment and assess which are reachable from untrusted networks; immediately restrict or isolate network access to the TCF debug service port (coordinate with operations teams). Within 7 days: Deploy firewall rules and network segmentation to limit access to terminal automation controllers from untrusted segments; configure logging and alerting on attempted connections to debug service ports on these devices. Within 30 days: Contact Toptech Systems requesting patch availability or supported mitigation roadmap (reference ICSA-26-211-03); initiate evaluation of replacement hardware with current security standards; develop and drill incident response procedures for controller compromise scenarios.

RCU II+ CVE-2026-12562

Q: What is the CVSS score of CVE-2026-12562?

CVE-2026-12562 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-51329 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-30 icscert

GHSA-w374-9vqx-5hr2

Authentication Bypass Rcu Ii Multiload Ii

8.7

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

8.7 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Unauthenticated adjacent-network TCF service (AV:A, AC:L, PR:N, UI:N) grants full root, so C/I/A all High; impact confined to the device, so S:U.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 30, 2026 - 23:04 EUVD

Analysis Updated

Jul 30, 2026 - 22:44 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 30, 2026 - 22:37 vuln.today

cvss_changed

CVSS changed

Jul 30, 2026 - 22:37 NVD

8.8 (HIGH) 8.7 (HIGH)

Analysis Generated

Jul 30, 2026 - 22:15 vuln.today

CVE Published

Jul 30, 2026 - 21:29 cve.org

HIGH 8.8

DescriptionCVE.org

The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. This vulnerability stems from a network-accessible port running a Target Communications Framework (TCF) service that does not require any authentication, allowing an attacker to directly interact with the Linux environment that powers the device. Once connected, an attacker can freely view and modify the filesystem, manipulate running processes, and control network interfaces, enabling deep alteration of system behavior.

AnalysisAI

Full root compromise of Toptech Systems RCU II+ and Multiload II+ terminal automation controllers is possible because they expose an unauthenticated Target Communications Framework (TCF) debug service on a network-reachable port. Any attacker on the adjacent network segment can connect and gain complete control of the underlying embedded Linux system without credentials. Reported via CISA ICS-CERT (ICSA-26-211-03); no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected devices are Toptech Systems RCU II+ and Multiload II+ controllers used in fuel/petroleum terminal loading-rack automation, running an embedded Linux OS (per CPE cpe:2.3:a:toptech_systems:rcu_ii+ and cpe:2.3:a:toptech_systems:multiload_ii+). The root cause is CWE-306 (Missing Authentication for Critical Function): the Target Communications Framework - an Eclipse TCF agent normally used for remote debugging and target control - is left running and network-accessible with no authentication. TCF is designed to allow a remote client to inspect and control a target's filesystem, processes, memory, and I/O, so exposing it unauthenticated effectively hands a remote debugger with root privileges to anyone who can reach the port.

RemediationAI

Apply the vendor firmware update for RCU II+/Multiload II+ (and SMP II+) from the Toptech firmware download portal (https://s3.amazonaws.com/docs.toptech.com/index.html#downloads/Firmware/RCUII+_MLII+_SMPII+/); an exact fixed version is not stated in the provided data, so verify the target version against the vendor notice (https://s3.amazonaws.com/docs.toptech.com/nonpublic/2025%2012%2001%20RCU%20IIPlus%20MultiLoad%20IIPlus%20Vulnerability%20Notice.pdf) and CISA advisory ICSA-26-211-03. As compensating controls where patching is delayed: isolate the devices on a dedicated OT VLAN and block the TCF/debug port with host or perimeter firewall ACLs so only explicitly authorized engineering hosts can reach it (trade-off: may break legitimate remote diagnostics/maintenance tooling that relies on TCF); disable the TCF service entirely if the vendor confirms it is not required for production operation (trade-off: loss of remote debug capability); and enforce strict network segmentation between IT and terminal-control networks per ISA/IEC 62443. Because AV:A limits the attack to the adjacent network, segmentation and access restriction are the highest-value mitigations.