Description
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access commands.
Published: 2026-10-17
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote File Read/Write
Action: Immediate Patch
AI Analysis

Impact

A path traversal flaw in the SCPI FILESystem command interface of Tektronix 3 Series MDO oscilloscopes allows an attacker to craft file paths that bypass directory restrictions, thereby reading or modifying arbitrary firmware and configuration files on the device. This vulnerability is classified as CWE-22 and could enable further compromise if critical system files are altered.

Affected Systems

Tektronix 3 Series MDO oscilloscopes with firmware versions earlier than 1.21.1 are affected.

Risk and Exploitability

Based on the description, it is inferred that the attack vector is remote exploitation via the SCPI protocol, requiring no authentication. The CVSS score of 8.1 indicates high severity, and the remote nature of the flaw suggests a broad attack surface. While the EPSS score is unavailable and the vulnerability is not listed in CISA KEV, the high CVSS makes it a serious risk that should be addressed promptly.

Generated by OpenCVE AI on October 17, 2026 at 04:01 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the oscilloscope firmware to version 1.21.1 or later to apply the vendor‑supplied fix.
  • Restrict SCPI FILESystem command access to trusted sources only, such as by disabling unsolicited SCPI packets or implementing firewall rules.
  • Segment the instrumentation network from general enterprise traffic and monitor for suspicious file‑access attempts.

Generated by OpenCVE AI on October 17, 2026 at 04:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Tektronix
Tektronix 3 Series Mdo
Vendors & Products Tektronix
Tektronix 3 Series Mdo

Sat, 17 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Title Path Traversal in Tektronix 3 Series MDO SCPI FileSystem Interface

Sat, 17 Oct 2026 02:15:00 +0000

Type Values Removed Values Added
Description An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access commands.
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Tektronix 3 Series Mdo
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-19T21:27:31.886Z

Reserved: 2026-10-17T01:04:40.618Z

Link: CVE-2026-111854

cve-icon Vulnrichment

Updated: 2026-10-19T21:27:23.816Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-17T02:17:18.750

Modified: 2026-10-19T22:17:03.853

Link: CVE-2026-111854

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T12:53:35Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')