CISA warns of high-severity flaw in Toptech Systems fuel device software

By Atlas Watchline Staff · Regulatory · August 1, 2026

CISA says a high-severity vulnerability in Toptech Systems RCU II+ and Multiload II+ devices could give an attacker root-level access if exploited.

CISA on July 30 issued an industrial control systems advisory warning about a high-severity vulnerability in Toptech Systems RCU II+ and Multiload II+ devices that could let an attacker gain root-level access if exploited.

The agency said successful exploitation could give an attacker full system control and access to, or manipulation of, connected networks and resources. CISA said the advisory covers devices used in the Energy sector and deployed worldwide.

In the advisory, CISA identified the issue as CVE-2026-12562 and categorized it as CWE-306, or missing authentication for a critical function. The agency assigned the flaw a CVSS v3.1 base score of 8.8, marked high, and a CVSS v4.0 base score of 8.7, also marked high.

CISA said the vulnerable condition involves an unauthenticated service that exposes a debug interface through a network-accessible port running Target Communications Framework, or TCF. According to the advisory, that setup can allow direct interaction with the Linux environment, viewing and changing the filesystem, manipulating running processes and controlling network interfaces.

The affected versions are listed as RCU II+ earlier than 2025-11-24 and Multiload II+ earlier than 2025-11-24. CISA said the product status is known_affected.

The agency said no known public exploitation specifically targeting the vulnerability has been reported to CISA, and it said the issue is not exploitable remotely.

CISA recommended three steps. The first is to move the device to a closed or segmented network without untrusted access. The second is to run one of Toptech’s RCU II+/Multiload II+ Vulnerability Removal Tools, available as .zip or .gz downloads. CISA said that option does not require breaking Weights and Measures seals and has the least operational impact.

The third option is to install the latest firmware from Toptech’s firmware downloads page. CISA said that method requires stopping the bay, breaking the W&M seal and backing up the current ML configuration first.

The advisory names Toptech Systems Support at security@toptech.com and cites an additional firmware vulnerability notice PDF from the company. CISA also credited Donald Green of Southwest Research Institute as the reporter.

What happens next depends on how operators choose to respond. CISA pointed readers to the vendor’s removal tools and firmware downloads, while the advisory remains the main public notice of the issue.

Sources

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.

View the Web StoryA visual, tap-through version of this report

This is the AMP version of the article. Read the full article on Atlas Watchline.