CISA has published an ICS advisory for Toptech Systems RCU II+ and Multiload II+ devices, used in the energy sector worldwide. The flaw, tracked as CVE-2026-12562 (CVSS v3 8.8), is a missing authentication for a critical function: a network-accessible Target Communications Framework (TCF) debug service exposes full root-level access to the underlying Linux environment without any credentials.
An attacker who reaches this port can view and modify the filesystem, control running processes, and manipulate the device — effectively achieving full system takeover and a potential pivot into connected operational networks. Versions prior to 2025-11-24 are affected.
What to take away: This is a classic no-authentication-required root access exposure. From an identity and access perspective, the lesson is that exposed management/debug interfaces without any authentication remain a top-tier risk; network segmentation and disabling or firewalling such services is essential, and operators should update to the fixed 2025-11-24 build.