CVE-2026-111853: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Tektronix 3 Series MDO

CVE-2026-111853 is an OS command injection vulnerability identified in Tektronix 3 Series MDO devices prior to version 1.21.1. The vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler, where user input is not properly sanitized, enabling remote attackers to execute arbitrary OS commands with elevated privileges. This vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The CVSS 3.1 base score is 8.8, indicating a high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and no known exploits in the wild have been reported.

Successful exploitation allows remote attackers to execute arbitrary operating system commands with elevated privileges on affected Tektronix 3 Series MDO devices. This can lead to full compromise of the device, including unauthorized data access, modification, or disruption of device functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable SCPI command interface to trusted users only and monitor for suspicious activity related to the FILESystem:MOUNT:DRIve command. Avoid exposing the device to untrusted networks.