The vulnerability is a classic operating system command injection flaw, identified as CWE‑78. Insufficient sanitization of the user‑supplied argument to the FILESystem:MOUNT:DRIve SCPI command allows a remote attacker to inject and execute arbitrary OS commands with elevated privileges. The impact is the ability to run any command on the underlying host, effectively compromising the entire device and any data or network resources it controls.

Tektronix 3 Series MDO oscilloscopes that run firmware versions prior to 1.21.1 are affected. This includes all variants of the 3 Series MDO model line, as detailed by Tektronix in their product documentation.

The vulnerability carries a CVSS score of 8.8, indicating high severity. The EPSS score is not available, so the current level of exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog, but the remote nature of the attack and the elevated privilege gain make it a critical concern for exposed devices.