An insufficiently validated file path in the web management interface of Tektronix 3 Series MDO devices allows a remote attacker to read arbitrary files that the application can access. The vulnerability can lead to disclosure of sensitive configuration or system files, which may compromise the confidentiality of the device and potentially the network it is connected to. The weakness is a classic directory traversal flaw.

Tektronix 3 Series MDO oscilloscopes running firmware versions prior to 1.21.1 are impacted. The issue resides in the built‑in web interface used for device configuration and monitoring.

The vulnerability has a CVSS score of 7.5, indicating a medium‑to‑high risk. No EPSS score is available, and it is not listed in the CISA KEV catalog, which suggests a lower but still real likelihood of exploitation. Because it may be feasible without authentication, an attacker can simply send a crafted HTTP request to traverse directories and read files. The attack vector is likely via the publicly accessible web interface, making it straightforward for an attacker to exploit if allowed through network exposure.