3 Series MDO EUVD-2026-103207

Exploitation requires network reach to the device's SCPI (Standard Commands for Programmable Instruments) control interface and the ability to invoke FILESystem access commands on a Tektronix 3 Series MDO running firmware before 1.21.1; the attacker supplies crafted file paths that the command interface fails to validate. Limiting factors: the SCPI interface is typically exposed only on lab/test networks rather than the public internet, and the input CVSS vector indicates PR:L (some privilege/access to the interface is needed) with no user interaction. The exact authentication model of the SCPI interface is not stated in the description and should be verified against the vendor advisory.

This is a meaningfully serious issue but likely a targeted rather than mass-exploitation risk. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) indicates a network-reachable, low-complexity flaw requiring some level of privilege (PR:L), delivering high confidentiality and integrity impact via arbitrary file read/modification - consistent with the CWE-22 path traversal in the SCPI FILESystem command interface. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence sources, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. The single largest tempering factor is real-world exposure: SCPI instrument-control interfaces are typically reachable only on lab/engineering network segments, not the open internet, so AV:N overstates practical reachability for most deployments. Net assessment: a credible high-severity vulnerability worth patching on exposed instruments, but not an emergency on par with internet-facing enterprise software absent any exploitation signal. Note the PR:L claim is from the input vector and is not independently corroborated by the description - SCPI interfaces frequently lack authentication, so the real privilege requirement should be verified against the vendor advisory (TEK-PSA-002-092026).

An attacker with access to the instrument's SCPI control interface on the local/engineering network sends a crafted FILESystem command containing directory-traversal sequences (e.g., ../) to escape the intended file path. This lets them read sensitive files or overwrite firmware/configuration/waveform files on the oscilloscope. No public exploit code was identified, and the low attack complexity means a working exploit would be straightforward to develop once the command syntax is known.