CVE-2026-111854: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Tektronix 3 Series MDO

CVE-2026-111854 is a path traversal vulnerability (CWE-22) affecting Tektronix 3 Series MDO devices prior to version 1.21.1. The issue arises from inadequate validation of file paths supplied to the SCPI FILESystem command interface, enabling remote attackers with low privileges to access or alter arbitrary files on the device. This can lead to unauthorized disclosure and modification of sensitive data. The vulnerability is remotely exploitable without user interaction and does not require elevated privileges beyond limited access.

Successful exploitation allows remote attackers with limited privileges to read or modify arbitrary files on affected Tektronix 3 Series MDO devices. This can compromise the confidentiality and integrity of device data. There is no impact on availability reported. The vulnerability has a high CVSS score of 8.1, reflecting the criticality of unauthorized file access and modification.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the SCPI FILESystem command interface and limit network exposure of affected devices to trusted users only.