---
id: "CVE-2026-111854"
kind: "vulnerability"
aliases: ["CVE-2026-111854"]
title: "Tektronix 3 Series MDO: path traversal lets remote users read or change device files"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "lab-equipment", "oscilloscope", "scpi", "tektronix"]
not_affected_if: ["firmware-1.21.1-or-later", "isolated-network"]
published_at: "2026-10-17T02:17:18+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T03:06:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111854", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Tektronix 3 Series MDO: path traversal lets remote users read or change device files

Tektronix 3 Series MDO oscilloscopes before firmware 1.21.1 accept SCPI FILESystem commands with paths that are not properly validated. A remote attacker can use path traversal to read or modify arbitrary files on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed firmware version on the device against `1.21.1`
- Confirm whether the SCPI interface is reachable from untrusted networks (unknown from sources)

## Fix

- Update Tektronix 3 Series MDO firmware to `1.21.1` or later
- Restrict network access to the instrument's SCPI port until patched

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111854

## From the sources

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access commands.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_