CVE-2026-12562

Received Received - Intake

Unauthenticated Root Access in RCU II+ and Multiload II+

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: ICS-CERT

Description

The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. This vulnerability stems from a network-accessible port running a Target Communications Framework (TCF) service that does not require any authentication, allowing an attacker to directly interact with the Linux environment that powers the device. Once connected, an attacker can freely view and modify the filesystem, manipulate running processes, and control network interfaces, enabling deep alteration of system behavior.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-12562

EUVD

EUVD-2026-51329

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

The RCU II+ and Multiload II+ devices have a debug interface exposed via a network port running a Target Communications Framework (TCF) service. This service does not require authentication, allowing unauthenticated attackers to gain full root-level access to the embedded Linux system. Attackers can view and modify files, manipulate processes, and control network settings, enabling complete system control.

Detection Guidance

Scan your network for open ports associated with the Target Communications Framework (TCF) service. Use commands like 'nmap -p <port> <target_IP>' to check for exposed debug interfaces. Inspect running services on the device for unauthorized TCF instances using 'ps aux | grep tcf' or similar.

Impact Analysis

An attacker could exploit this to take full control of the device, steal sensitive data, disrupt operations, or use the device as a foothold to move laterally within a network. This could lead to data breaches, system failures, or unauthorized access to connected systems.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and system integrity, such as GDPR (data confidentiality) and HIPAA (protected health information security). Unauthorized access could result in regulatory penalties, legal liabilities, and loss of trust due to compromised sensitive data.

Mitigation Strategies

Immediately block network access to the vulnerable TCF service port using firewall rules. Disable or remove the unauthenticated debug interface if possible. Update the device firmware if a patch is available from the vendor.

Hi! I’m here to help you understand CVE-2026-12562. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70