CVE-2026-111855: Path Traversal

Q: Does an attacker need credentials to exploit this issue?

Depending on the device configuration, exploitation may be possible without authentication. The available information does not identify which configurations require authentication.

Q: What level of access and interaction does exploitation require?

The CVSS vector indicates remote network access, low attack complexity, no required privileges, and no user interaction. The affected component is the device's web management interface.

Q: Can exploitation modify files or affect device availability?

The stated impact is disclosure of files readable by the application. The CVSS vector indicates no integrity or availability impact.

Published Oct 17, 2026

Updated

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient validation of user-supplied file paths allows remote attackers to read arbitrary files accessible to the application. Depending on configuration, exploitation may be possible without authentication.

Affected Software

1 affected component

Tektronix 3 Series MDO<1.21.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Tektronix 3 Series MDO to a version that resolves this vulnerability.
Fixed in 1.21.1

Event History

Oct 17, 2026

CVE Published

via MITRE·02:09 AM

Data Sourced

via MITRE·02:09 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Does an attacker need credentials to exploit this issue?

Depending on the device configuration, exploitation may be possible without authentication. The available information does not identify which configurations require authentication.

What level of access and interaction does exploitation require?