VulnHub

Real-time Cybersecurity News

Critical

Toptech Systems RCU II+ and Multiload II+

All CISA Advisories
LinuxCVEVulnerabilityUpdateCritical

Overview

Toptech Systems has reported a serious vulnerability in its RCU II+ and Multiload II+ products, which could allow attackers to gain unauthorized control over these devices. The flaw, identified as CVE-2026-12562, affects all versions of RCU II+ and Multiload II+ released before November 24, 2025. This vulnerability stems from a debug interface that lacks authentication, enabling attackers to access the system's Linux environment directly. If exploited, this could lead to significant manipulation of connected networks and resources. Users are urged to take defensive measures, including isolating the devices from untrusted networks and applying available vulnerability removal tools or firmware updates to protect against potential exploitation.

Key Takeaways

  • Affected Systems: Toptech Systems RCU II+ (<2025-11-24), Toptech Systems Multiload II+ (<2025-11-24)
  • Action Required: 1.
  • Timeline: Disclosed on 2026-07-30

Original Article Summary

View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to gain full system control and misuse it to access or manipulate connected networks and resources. The following versions of Toptech Systems RCU II+ and Multiload II+ are affected: RCU II+ <2025-11-24 (CVE-2026-12562) Multiload II+ <2025-11-24 (CVE-2026-12562) CVSS Vendor Equipment Vulnerabilities v3 8.8 Toptech Systems Toptech Systems RCU II+ and Multiload II+ Missing Authentication for Critical Function Background Critical Infrastructure Sectors: Energy Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2026-12562 The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. This vulnerability stems from a network-accessible port running a Target Communications Framework (TCF) service that does not require any authentication, allowing an attacker to directly interact with the Linux environment that powers the device. Once connected, an attacker can freely view and modify the filesystem, manipulate running processes, and control network interfaces, enabling deep alteration of system behavior. View CVE Details Affected Products Toptech Systems RCU II+ and Multiload II+ Vendor: Toptech Systems Product Version: Toptech Systems RCU II+: <2025-11-24, Toptech Systems Multiload II+: <2025-11-24 Product Status: known_affected Remediations Mitigation Toptech Systems provides two methods for remediating affected RCU II+ and Multiload II+ units: First, move the device to a closed or segmented network without untrusted access. Mitigation Run one of the RCU II+/Multiload II+ Vulnerability Removal Tools (VRT) available at https://s3.amazonaws.com/docs.toptech.com/nonpublic/rcuiip_mliip_vrt.zip, https://s3.amazonaws.com/docs.toptech.com/nonpublic/rcuiip_mliip_vrt.gz. *-* This option does not require breaking Weights and Measures seals and has the least operational impact. https://s3.amazonaws.com/docs.toptech.com/nonpublic/rcuiip_mliip_vrt.zip Mitigation Run one of the RCU II+/Multiload II+ Vulnerability Removal Tools (VRT) available at https://s3.amazonaws.com/docs.toptech.com/nonpublic/rcuiip_mliip_vrt.zip, https://s3.amazonaws.com/docs.toptech.com/nonpublic/rcuiip_mliip_vrt.gz. *-* This option does not require breaking Weights and Measures seals and has the least operational impact. https://s3.amazonaws.com/docs.toptech.com/nonpublic/rcuiip_mliip_vrt.gz Mitigation This option does not require breaking Weights and Measures seals and has the least operational impact. Mitigation Install the latest firmware from https://s3.amazonaws.com/docs.toptech.com/index.html#downloads/Firmware/RCUII+_MLII+_SMPII+/. *-* This method requires stopping the bay and breaking the W&M seal. Be sure to back up the current ML configuration before performing the firmware update. https://s3.amazonaws.com/docs.toptech.com/index.html#downloads/Firmware/RCUII+_MLII+_SMPII+/ Mitigation This method requires stopping the bay and breaking the W&M seal. Be sure to back up the current ML configuration before performing the firmware update. Mitigation For questions, contact Toptech Systems Support at security@toptech.com. Additional details are available in Toptech System's firmware vulnerability notice: https://s3.amazonaws.com/docs.toptech.com/nonpublic/2025%2012%2001%20RCU%20IIPlus%20MultiLoad%20IIPlus%20Vulnerability%20Notice.pdf. mailto:security@toptech.com Mitigation For questions, contact Toptech Systems Support at security@toptech.com. Additional details are available in Toptech System's firmware vulnerability notice: https://s3.amazonaws.com/docs.toptech.com/nonpublic/2025%2012%2001%20RCU%20IIPlus%20MultiLoad%20IIPlus%20Vulnerability%20Notice.pdf. https://s3.amazonaws.com/docs.toptech.com/nonpublic/2025%2012%2001%20RCU%20IIPlus%20MultiLoad%20IIPlus%20Vulnerability%20Notice.pdf Relevant CWE: CWE-306 Missing Authentication for Critical Function Metrics CVSS Version Base Score Base Severity Vector String 3.1 8.8 HIGH CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 4.0 8.7 HIGH CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Acknowledgments Donald Green of Southwest Research Institute reported this vulnerability to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely. Revision History Initial Release Date: 2026-07-30 Date Revision Summary 2026-07-30 1 Initial Publication Legal Notice and Terms of Use

Impact

Toptech Systems RCU II+ (<2025-11-24), Toptech Systems Multiload II+ (<2025-11-24)

Exploitation Status

No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.

Timeline

Disclosed on 2026-07-30

Remediation

1. Move the device to a closed or segmented network without untrusted access. 2. Run the RCU II+/Multiload II+ Vulnerability Removal Tools (VRT) available at the provided links. 3. Install the latest firmware from the provided link, which requires stopping the bay and breaking the Weights and Measures seal. Ensure to back up the current configuration before performing the firmware update.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Linux, CVE, Vulnerability, and 2 more.

Read Original Article

Related Coverage

AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes

BleepingComputer

A new phishing-as-a-service platform named AnonyMousKIT has been discovered, which automates the process of stealing passcodes from iPhones. This service utilizes voice AI agents to trick users into providing their unlock codes, specifically targeting those who have had their Apple devices stolen. Once attackers obtain the passcodes, they can disable the Activation Lock, allowing them to access and potentially resell the stolen devices. This poses a significant risk to iPhone users, as it could lead to increased theft and exploitation of stolen devices. Users are urged to remain vigilant and skeptical of unsolicited calls requesting sensitive information.

Aug 25, 2026

Arrested man allegedly impersonated NSA elite hacking unit, Supreme Court chief justice

CyberScoop

Joshua Culver, also known as 'Maverick Young,' has been arrested for allegedly impersonating a high-ranking official from the NSA's Tailored Access Operations unit, which is known for its elite hacking capabilities. This incident reportedly took place during a period when the unit was not publicly referred to by that name, raising concerns about the potential for misuse of sensitive information and authority. Culver is also accused of impersonating the Chief Justice of the Supreme Court. This type of impersonation can have serious implications for national security and the integrity of government institutions, as it can undermine trust in official communications. Law enforcement continues to investigate the full extent of Culver's actions and any potential victims affected by his impersonations.

Aug 25, 2026

U.S. Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches

The Hacker News

The U.S. Department of the Treasury has imposed new sanctions on Iranian hackers linked to breaches of critical infrastructure. This move is part of a broader strategy to cut off Iran's financial resources and disrupt its cyber operations. The sanctions target individuals and entities believed to be involved in cyber attacks that threaten vital systems. By taking this action, the U.S. aims to hold accountable those responsible for these security breaches and to deter future cyber threats from Iran. This development is significant as it underscores the ongoing geopolitical tensions and the role of cyber warfare in international relations.

Aug 25, 2026

CISA adds Oracle WebLogic bug to its list of exploited vulnerabilities

SCM feed for Latest

The Cybersecurity and Infrastructure Security Agency (CISA) has added a newly identified vulnerability in Oracle WebLogic to its list of actively exploited security issues. This vulnerability allows attackers to gain access to core business applications within an enterprise, posing significant risks to sensitive data and operations. Organizations using Oracle WebLogic middleware need to be particularly vigilant, as this exploitation could lead to severe disruptions and data breaches. Experts recommend that affected companies prioritize patching this vulnerability to safeguard their systems. The urgency is underscored by the fact that attackers are actively exploiting this flaw.

Aug 25, 2026

Norway ’s Digital Government Infrastructure Hit by a new DDoS Attack

Security Affairs

Norway's shared government digital infrastructure faced its third distributed denial-of-service (DDoS) attack on August 24, 2023, starting at 03:38 CEST. This attack disrupted various online services that citizens, businesses, and public agencies rely on. Fortunately, officials reported no indications of data breaches or compromise during the incident. The repeated nature of these attacks raises concerns about the resilience of Norway's digital systems and their ability to withstand ongoing cyber threats. This incident highlights the need for stronger cybersecurity measures to protect essential public services.

Aug 25, 2026

Water sector passes, government sector fails attempts to spot and halt simulated CISA attack

CyberScoop

In a recent cybersecurity test, red-teamers conducted simulated attacks on both the water and government sectors to evaluate their response capabilities. The water sector successfully identified and contained the simulated threats, effectively preventing any further access. In contrast, the government sector failed to manage the attack, allowing the red-teamers to gain initial access without detection. This incident illustrates the varying levels of preparedness among critical infrastructure sectors and raises concerns about the government's ability to secure sensitive systems against potential real-world attacks. The implications of such failures could be significant, especially given the importance of both sectors in maintaining public safety and national security.

Aug 25, 2026