Controllers that meter and load fuel at terminals are shipping with a debug service that requires no authentication at all and gives whoever reaches it full root access to the underlying Linux system. CISA published an advisory on July 30, 2026 for the flaw, tracked as CVE-2026-12562 and rated 8.8 on CVSS v3.1 (8.7 on CVSS v4), affecting Toptech Systems RCU II+ and Multiload II+ units running firmware older than the 2025-11-24 release.
The problem is a network-accessible port running a Target Communications Framework (TCF) service, a remote debugging protocol, with nothing asking for credentials in front of it. Per CISA's advisory, an attacker who connects can freely view and modify the filesystem, manipulate running processes and control network interfaces, which adds up to deep alteration of how the device behaves. CISA classes it as CWE-306, missing authentication for a critical function. Donald Green of Southwest Research Institute reported the vulnerability to CISA.
What's affected
Toptech Systems is headquartered in the United States and its equipment is deployed worldwide in the energy sector, where these units sit between terminal automation systems and the physical loading equipment. Both product lines are listed as affected below the 2025-11-24 build: RCU II+ and Multiload II+.
One detail keeps this short of a worst case. CISA states the vulnerability is not exploitable remotely, and the CVSS vector is adjacent network (AV:A), meaning an attacker needs a foothold on the same network segment rather than an internet connection. CISA also says no public exploitation specifically targeting this flaw has been reported to it. That caveat rests on the business and OT networks actually being as separate as the network diagram claims, which is exactly the assumption that tends to fail during an intrusion.
What you should do
Toptech offers two remediation paths, and the operationally cheaper one is worth knowing about. Running the RCU II+ and Multiload II+ Vulnerability Removal Tool (VRT) fixes the exposure without breaking Weights and Measures seals, the controlled seals on custody-transfer metering equipment, so a loading bay does not have to be stopped. Installing the latest firmware also remediates it, but that route requires stopping the bay and breaking the W and M seal, and Toptech advises backing up the current Multiload configuration first. Both are distributed from Toptech's documentation filestore, and the vendor directs questions to security[at]toptech[.]com.
The interim control CISA recommends is the one it gives for most industrial gear: move the device onto a closed or segmented network without untrusted access, keep control system networks behind firewalls and isolated from business networks, and use a VPN for remote access instead of exposing the device directly. That advice keeps recurring across this month's ICS advisories covering Rockwell and ABB equipment, and it matters because unauthenticated root on an embedded controller is precisely what turned a chain of Siemens RUGGEDCOM switch bugs into a route across an OT network.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.