How do I check whether I am affected by CVE-2026-111854?

- Check the installed firmware version on the device against `1.21.1` - Confirm whether the SCPI interface is reachable from untrusted networks (unknown from sources)

What is the fix for CVE-2026-111854?

- Update Tektronix 3 Series MDO firmware to `1.21.1` or later - Restrict network access to the instrument's SCPI port until patched

Who is not affected by CVE-2026-111854?

Not affected if: firmware-1.21.1-or-later, isolated-network.

Live › vulnerability › CVE-2026-111854

Go to dashboard

high8.1Infrastructure

Tektronix 3 Series MDO: path traversal lets remote users read or change device files

Tektronix 3 Series MDO oscilloscopes before firmware 1.21.1 accept SCPI FILESystem commands with paths that are not properly validated. A remote attacker can use path traversal to read or modify arbitrary files on the device.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.1

high

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 17, 2026 UTC
Last modified: Oct 19, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Remote attacker reads or modifies arbitrary files on the device.
CVSS said: 8.1. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

Labs and test benches running Tektronix 3 Series MDO oscilloscopes with firmware earlier than 1.21.1 that expose the SCPI interface over a network. Devices kept on isolated bench networks with no remote access are less exposed. Sources do not confirm whether a default configuration exposes the filesystem commands.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-111854

Go to dashboard

high8.1Infrastructure

Tektronix 3 Series MDO: path traversal lets remote users read or change device files

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.1

high

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 17, 2026 UTC
Last modified: Oct 19, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Remote attacker reads or modifies arbitrary files on the device.
CVSS said: 8.1. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

Know the next one before it finds you.

Add to Slack

Tektronix 3 Series MDO: path traversal lets remote users read or change device files

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

Tektronix 3 Series MDO: path traversal lets remote users read or change device files

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources