AI analysis
CVE-2026-69662 is an eval-injection flaw (CWE-95) in Toptech TMS7 and TopHAT: the applications use unsafe functions that can run inline scripts and evaluate strings as code. An attacker who already has low privileges and can reach a system from an adjacent network may be able to trigger that behavior; attack complexity is high and no user interaction is required. Successful exploitation can cause limited loss of confidentiality and integrity on the vulnerable system, with no availability impact and no impact on subsequent systems, matching the low CVSS 4.0 score of 2.1. Operators of these terminal-management products are affected; the provided data does not name version ranges. The issue is not in CISA KEV, and no public proof-of-concept is known.
What to do: Follow the CISA ICS-CERT advisory for CVE-2026-69662 and apply any Toptech fixes or configuration guidance for TMS7 and TopHAT as they are published; no fixed version is named in the provided data. Until then, restrict adjacent-network access to these systems to trusted hosts and low-privilege accounts, and review configuration for inline-script or string-evaluation features. No public exploit is known; treat unexpected script execution as something to investigate.
Affected
| Toptech TMS7 | — |
| Toptech TopHAT | — |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.