{"id":"CVE-2026-111854","kind":"vulnerability","aliases":["CVE-2026-111854"],"related":[],"title":"Tektronix 3 Series MDO: path traversal lets remote users read or change device files","description":"An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access commands.","summary":"Tektronix 3 Series MDO oscilloscopes before firmware 1.21.1 accept SCPI FILESystem commands with paths that are not properly validated. A remote attacker can use path traversal to read or modify arbitrary files on the device.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","lab-equipment","oscilloscope","scpi","tektronix"],"not_affected_if":["firmware-1.21.1-or-later","isolated-network"],"how_to_check":"- Check the installed firmware version on the device against `1.21.1`\n- Confirm whether the SCPI interface is reachable from untrusted networks (unknown from sources)","fix":"- Update Tektronix 3 Series MDO firmware to `1.21.1` or later\n- Restrict network access to the instrument's SCPI port until patched","status":"open","published_at":"2026-10-17T02:17:18+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:06:40+00:00","updated_at":"2026-10-25T03:06:40+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:06:40Z","model":"claude-haiku-5-5","output":{"fix":"- Update Tektronix 3 Series MDO firmware to `1.21.1` or later\n- Restrict network access to the instrument's SCPI port until patched","reach":"network","title":"Tektronix 3 Series MDO: path traversal lets remote users read or change device files","impact":"high","summary":"Tektronix 3 Series MDO oscilloscopes before firmware 1.21.1 accept SCPI FILESystem commands with paths that are not properly validated. A remote attacker can use path traversal to read or modify arbitrary files on the device.","category":"infrastructure","nicknames":[],"who_cares":["tektronix","oscilloscope","scpi","lab-equipment"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote attacker reads or modifies arbitrary files on the device","analyst_note":"Confirm from the Tektronix advisory whether authentication is required and whether the SCPI interface is enabled by default.","how_to_check":"- Check the installed firmware version on the device against `1.21.1`\n- Confirm whether the SCPI interface is reachable from untrusted networks (unknown from sources)","needs_analyst":true,"not_affected_if":["firmware-1.21.1-or-later","isolated-network"],"who_is_affected":"Labs and test benches running Tektronix 3 Series MDO oscilloscopes with firmware earlier than 1.21.1 that expose the SCPI interface over a network. Devices kept on isolated bench networks with no remote access are less exposed. Sources do not confirm whether a default configuration exposes the filesystem commands.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000625,"input_tokens":3308,"output_tokens":588,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111854':17A,20A '-2026':16A,19A '1.21.1':35B,74C '3':2A,29B,69C 'accept':36B 'access':106C 'allow':85C 'arbitrari':58B,92C 'attack':49B,87C 'chang':12A 'command':39B,83C,107C 'cve':15A,18A 'devic':13A,62B,72C,96C 'discov':66C 'equip':24B 'file':14A,59B,93C,101C 'filesystem':38B,82C,105C 'firmwar':34B 'infrastructur':21B 'insuffici':98C 'interfac':84C 'issu':64C 'lab':23B 'lab-equip':22B 'let':7A 'mdo':4A,31B,71C 'modifi':57B,91C 'oscilloscop':25B,32B 'path':5A,41B,52B,76C,102C 'proper':45B 'read':10A,55B,89C 'remot':8A,48B,86C 'scpi':26B,37B,81C 'seri':3A,30B,70C 'suppli':103C 'tektronix':1A,27B,28B,68C 'travers':6A,53B,77C 'use':51B 'user':9A 'valid':46B,99C 'vulner':78C","nicknames":[],"mitigations":[],"who_affected":"Labs and test benches running Tektronix 3 Series MDO oscilloscopes with firmware earlier than 1.21.1 that expose the SCPI interface over a network. Devices kept on isolated bench networks with no remote access are less exposed. Sources do not confirm whether a default configuration exposes the filesystem commands.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T02:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111854","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111854","severity":null,"published_at":"2026-10-17T02:17:18+00:00","modified_at":"2026-10-19T22:17:03+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}