CVE-2026-111855

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient validation of user-supplied file paths allows remote attackers to read arbitrary files accessible to the application. Depending on configuration, exploitation may be possible without authentication.

An attacker could access sensitive files on the device, potentially leading to leakage of configuration data or other confidential information. In some configurations, exploitation may not require authentication, increasing the risk.

Update Tektronix 3 Series MDO device firmware to version 1.21.1 or later. Restrict access to the web management interface to trusted networks.