CVE-2026-12562— Toptech Systems RCU II 授权问题漏洞

Toptech Systems RCU II+ and Multiload II+ Missing Authentication for Critical Function

The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. This vulnerability stems from a network-accessible port running a Target Communications Framework (TCF) service that does not require any authentication, allowing an attacker to directly interact with the Linux environment that powers the device. Once connected, an attacker can freely view and modify the filesystem, manipulate running processes, and control network interfaces, enabling deep alteration of system behavior.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

关键功能的认证机制缺失

Toptech Systems RCU II 授权问题漏洞

Toptech Systems RCU II是Toptech Systems的一款工业自动化控制设备。 Toptech Systems RCU II+和Multiload II+ 2025-11-24之前版本存在授权问题漏洞，该漏洞源于网络可达端口运行Target Communications Framework (TCF)服务且无需身份验证，可能导致攻击者直接与Linux环境交互，查看和修改文件系统、操作运行进程、控制网络接口，实现深度修改系统行为。

N/A

N/A