3 Series MDO CVE-2026-111853

Exploitation requires network reachability to the instrument's SCPI remote-control interface (LAN/VXI-11/raw-socket control port) and the ability to issue the FILESystem:MOUNT:DRIve SCPI command; the attacker must be able to send command input that reaches this specific handler. The affected feature is the drive-mount filesystem SCPI command, present on Tektronix 3 Series MDO devices running firmware before 1.21.1 - devices patched to 1.21.1 or later are not affected. Limiting factors: CVSS indicates PR:L, so some level of existing access/privilege to the control interface is assumed (authentication requirement not independently confirmed from available data), and the instrument must be network-exposed rather than operated purely via its front panel; no user interaction (UI:N) is required. Realistic risk is bounded to attackers who already have a foothold on the lab/engineering network where the scope is deployed.

This is a credible operational-technology risk, though not a mass-exploitation emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring some level of existing privilege (PR:L), with full High impact to confidentiality, integrity, and availability, yielding the 8.8 base score. The flaw is an OS command injection (CWE-78) in the FILESystem:MOUNT:DRIve SCPI command handler that executes with elevated privileges, so a successful attack likely yields root/administrative control of the instrument's embedded OS - an unusually high technical impact for lab/test equipment. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the real-world threat is therefore driven by impact severity rather than demonstrated exploitation. The PR:L metric is the key limiting signal: exploitation presumes an attacker can reach and interact with the SCPI control interface (typically exposed over LAN/VXI-11/raw socket on a lab or engineering network), which constrains this to attackers already on the network segment rather than internet-wide opportunistic actors. Note a potential conflict to verify with the vendor: SCPI control interfaces on many instruments are unauthenticated by design, which would argue for PR:N - NVD rates it PR:L, so the precise authentication prerequisite should be confirmed against the Tektronix advisory (TEK-PSA-002-092026).

An attacker with access to the lab/engineering network segment where a Tektronix 3 Series MDO is reachable sends a crafted FILESystem:MOUNT:DRIve SCPI command containing shell metacharacters to the instrument's remote control interface. Because user input is insufficiently neutralized, the injected commands execute with elevated privileges on the device's embedded OS, giving the attacker full control of the instrument. No public exploit code was identified at time of analysis, and the CVSS low attack complexity (AC:L) indicates no special timing or race conditions are needed once interface access is obtained.