Toptech Systems RCU II+ and Multiload II+

The core failure here is the exposure of an unauthenticated debug interface (TCF service) on production industrial control system devices, granting any attacker on the network full root-level access without requiring credentials. Debug interfaces are development conveniences that should never be left enabled or exposed in production environments, yet this flaw persisted until a patch released in late 2025. The impact is severe because these devices manage fuel loading and terminal control systems, meaning a successful attack could manipulate physical processes, disrupt operations, or cause safety incidents. This vulnerability highlights a systemic gap in secure-by-default product configuration and the critical need for timely patching of OT/ICS infrastructure.