Read the docs
TI-2026-76076 Aliases CVE-2026-111855GHSA-grh2-338g-6c79

Path traversal in Tektronix 3 Series MDO web interface lets attackers read files

Priority MEDIUM 40CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Tektronix 3 Series MDO devices before 1.21.1 are affected. A path traversal flaw (CWE-22) exists in the web management interface, where insufficient validation of user-supplied file paths lets remote attackers read arbitrary files accessible to the application. Depending on configuration, an attacker may not need to authenticate.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient validation of user-supplied file paths allows remote attackers to read arbitrary files accessible to the application. Depending on configuration, exploitation may be possible without authentication.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00608 49th percentileScored 2026-11-07
Fix Fixed 3 Series MDO (Tektronix): 1.21.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Tektronix3 Series MDObefore 1.21.11.21.1Patch availableCNA
  • 3 Series MDO VendorTektronix Affected before 1.21.1 Fixed in 1.21.1 Patch available CNA

Remediation

Update Tektronix 3 Series MDO devices to version 1.21.1.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA 3 Series MDO (Tektronix) Fixed in 1.21.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Tektronix 3 Series MDO 1.21.1

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-76074 OS command injection in Tektronix 3 Series MDO SCPI command handlerPriority MEDIUM 42
    • TI-2026-76075 Path traversal in Tektronix 3 Series MDO SCPI FILESystem commandPriority LOW 38
    Show all 3 records →

Timeline

  1. 2026-10-18 Threatist record created from CVE-2026-111855
  2. 2026-10-18 Alias added: GHSA-grh2-338g-6c79
  3. 2026-10-18 Priority changed: MEDIUM → LOW
  4. 2026-10-21 CISA SSVC decision points changed
  5. 2026-10-25 Priority changed: LOW → MEDIUM

References

Other 2

  • TI-2026-76074 OS command injection in Tektronix 3 Series MDO SCPI command handler CVSS 3.1HIGH 8.8
  • TI-2026-76075 Path traversal in Tektronix 3 Series MDO SCPI FILESystem command CVSS 3.1HIGH 8.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences