CVE-2026-111855
7.5HighPublished 17 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-22
Impact
Remote attackers with network access to the device can read arbitrary files via the web management interface. This may be exploited without authentication depending on the device configuration.
Root cause
The web management interface fails to properly validate user-supplied file paths, allowing path traversal.
Affected systems
Tektronix 3 Series MDO devices before 1.21.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
Upgrade device firmware to version 1.21.1 or later. If patching immediately is not possible, restrict network access to the web management interface via firewalls or disable the web interface if supported.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient validation of user-supplied file paths allows remote attackers to read arbitrary files accessible to the application. Depending on configuration, exploitation may be possible without authentication.