Executive brief
Toptech Systems RCU II+ and Multiload II+ devices, which are used in the energy sector for terminal automation and flow control, contain a security flaw that allows unauthorized access. An attacker on the same local network can bypass security controls to gain full administrative control over the device. This could allow them to disrupt operations, manipulate fuel loading processes, or access sensitive system data.
Technical details
The RCU II+ and Multiload II+ embedded systems expose a Target Communications Framework (TCF) service on a network-accessible port without requiring authentication (CWE-306). This debug interface provides direct, unauthenticated root-level access to the underlying Linux operating system. An attacker with adjacent network access can interact with the TCF service to view or modify the filesystem, manipulate running processes, and reconfigure network interfaces. Toptech Systems has released a Vulnerability Removal Tool (VRT) and updated firmware to address the issue.
Affected products
- Toptech Systems RCU II+ < 2025-11-24
- Toptech Systems Multiload II+ < 2025-11-24
Timeline
- 2026-07-30: advisory: CISA published advisory ICSA-26-211-03
- 2026-07-30: disclosed
References
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-03.json
- https://s3.amazonaws.com/docs.toptech.com/index.html
- https://s3.amazonaws.com/docs.toptech.com/nonpublic/2025%2012%2001%20RCU%20IIPlus%20MultiLoad%20IIPlus%20Vulnerability%20Notice.pdf
- https://s3.amazonaws.com/docs.toptech.com/nonpublic/rcuiip_mliip_vrt.gz
- https://s3.amazonaws.com/docs.toptech.com/nonpublic/rcuiip_mliip_vrt.zip
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-03