CVE-2026-111853
HighCVSS 8.8Summary
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with elevated privileges.
Risk Assessment
An attacker could execute arbitrary OS commands with elevated privileges, potentially leading to full device compromise. This could result in malware installation, data theft, or using the device as a network entry point.
Recommendation
Update Tektronix 3 Series MDO device firmware to version 1.21.1 or later. Restrict access to the SCPI interface to trusted networks.
Other vulnerabilities in Tektronix 3 Series MDO
See all- CVE-2026-111855High
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient validation of user-supplied file paths allows remote attackers to read arbitrary files accessible to the application. Depending on configuration, exploitation may be possible without authentication.
- CVE-2026-111854High
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access commands.
Original NVD description (English source)
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with elevated privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS