Tektronix 3 Series MDO EUVD-2026-103208

Requires network reachability to the web management interface of a Tektronix 3 Series MDO device running firmware before 1.21.1; the attacker supplies manipulated file paths that the interface fails to validate. The key limiting factor is deployment-dependent authentication: the description states unauthenticated access is possible only 'depending on configuration,' implying some deployments require authentication to the management interface, so the practical PR:N assumption is not guaranteed. Exploitation is further bounded by the device being an isolatable lab instrument typically not internet-exposed, and impact is limited to reading files accessible to the application (no write/execute).

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N, score 7.5) describes a network-reachable, low-complexity information-disclosure flaw requiring no privileges or user interaction. However, this conflicts with the description, which states exploitation is unauthenticated only 'depending on configuration' - so the PR:N assumption may not hold in all deployments; verify authentication requirements against the vendor advisory (TEK-PSA-002-092026). No EPSS score, CISA KEV listing, or public POC was provided, so there is no evidence of active exploitation or available exploit code at time of analysis. Impact is confined to confidentiality (arbitrary file read, no integrity or availability effect), which caps real-world severity below code-execution path-traversal variants. Net assessment: a genuine but moderate-priority issue - the high CVSS is driven entirely by easy remote reachability and full confidentiality loss, tempered by the configuration-dependent authentication caveat and the niche, lab-instrument deployment footprint, which make mass opportunistic exploitation less likely than the raw score suggests.

A remote attacker with network access to the oscilloscope's web management interface submits a crafted request containing directory-traversal sequences (e.g., ../../) in a file-path parameter, causing the application to return files outside the intended directory - potentially configuration files, credentials, or firmware artifacts readable by the web application. Because exploitation can be unauthenticated depending on configuration (AC:L, no user interaction), the request is trivial to automate against reachable devices. No public exploit code was identified in the provided intelligence.