CVE-2026-111854
8.1HighPublished 17 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-22
Impact
Authenticated remote attackers can read or overwrite arbitrary files on the oscilloscope via SCPI commands. They need network access to the instrument's control interface and valid low-privilege credentials.
Root cause
The SCPI FILESystem command interface fails to sanitize file paths, permitting path traversal sequences in file access commands.
Affected systems
Tektronix 3 Series MDO devices running firmware versions before 1.21.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Fix & remediation
Upgrade device firmware to version 1.21.1 or later. If patching immediately is not possible, isolate the device from the network or restrict access to the SCPI port via network firewalls.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access commands.