Tektronix 3 Series MDO: Path traversal in SCPI FILESystem command interface
Summary
Tektronix 3 Series MDO oscilloscopes before firmware 1.21.1 contain a path traversal flaw in the SCPI FILESystem command interface. Insufficient validation of file paths allows a remote attacker with low privileges to read or modify arbitrary files on the device. Confidentiality and integrity are affected, while availability is not.
Affected
- Tektronix 3 Series MDO, firmware versions before 1.21.1 (per CNA data; the vendor advisory was not verified)
Fixed in
- Firmware 1.21.1 (per CVE record reference to Tektronix advisory TEK-PSA-002-092026; exact fix wording unverified)
Workaround
- No vendor-published workaround found.
- Restrict network access to the SCPI service with strict firewall rules (generic suggestion from VulDB).
- Keep the instrument off untrusted networks.
Exploitation
- No public proof of concept or known exploitation found.
- Not listed in CISA KEV (per Strix; CISA KEV not checked directly).
- CISA SSVC: exploitation none, automatable no, technical impact total.
- VulDB lists a CVSS of 6.3; the CNA vector gives 8.1. NVD analysis is pending.
Our recommendation
- Inventory all 3 Series MDO units and their firmware versions.
- Upgrade to firmware 1.21.1 or later after confirming the version in the Tektronix advisory.
- Until patched, remove SCPI and web access from untrusted networks and restrict access to named management hosts.
- Patch CVE-2026-111853 and CVE-2026-111855 together, as they are fixed in the same release per aggregators.
- Monitor NVD and CISA KEV for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Tektronix security advisory TEK-PSA-002-092026 download.tek.com
- Tektronix 3 Series MDO product page www.tek.com
- VulDB CVE-2026-111854 vuldb.com
- VulDB vulnerability 421537 vuldb.com
- CNA data mirror CVE-2026-111854 cve.threatint.com
- Strix CVE-2026-111854 www.strix.ai
- Strix CVE-2026-111853 www.strix.ai
- Strix CVE-2026-111855 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:51.
Original description (NVD)
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access commands.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.