CVE-2026-111853: OS Command Injection
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with elevated privileges.
Affected Software
Event History
Frequently Asked Questions
Which systems are affected?
Tektronix 3 Series MDO devices running firmware versions before 1.21.1 are affected.
What access does an attacker need to exploit this issue?
The vulnerability is remotely exploitable over the network with low privileges. No user interaction is required.
What is the impact of successful exploitation?
An attacker can inject operating system commands through the FILESystem:MOUNT:DRIve SCPI command handler and execute them with elevated privileges. This can compromise confidentiality, integrity, and availability.
What is the remediation?
Update affected Tektronix 3 Series MDO devices to firmware version 1.21.1 or later.