Which versions of Eppendorf BioFlo 320 are affected by CVE-2026-7251?

The Eppendorf BioFlo 320 bioprocess control system contains hard-coded VNC credentials, enabling unauthenticated remote control of critical bioprocess operations with CVSS 9.3 severity.

How to fix or mitigate CVE-2026-7251?

24 hours: Identify all Eppendorf BioFlo 320 systems in your environment; restrict network access to essential connections only; disable remote VNC access where operationally feasible. 7 days: Implement network segmentation (dedicated VLAN or air gap) for bioprocess systems; deploy network intrusion detection and comprehensive access logging; monitor for unauthorized access attempts. 30 days: Contact Eppendorf for interim mitigations or firmware updates; evaluate replacement hardware or alternative control systems; document and test manual operational procedures.

Eppendorf BioFlo 320 CVE-2026-7251

Q: What is the CVSS score of CVE-2026-7251?

CVE-2026-7251 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-31912 CRITICAL

Use of Hard-coded Password (CWE-259)

2026-05-26 icscert

GHSA-v6xg-wr2p-xrj3

Authentication Bypass Bioflo 320

9.3

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (icscert) · only source for this CVE.

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 08:38 vuln.today

CVSS changed

May 26, 2026 - 18:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

DescriptionCVE.org

Eppendorf BioFlo 320 is vulnerable to due to VNC server using a hard-coded password. If a remote attacker knows the network address of any BioFlo 320 model with remote access enabled, they can gain full control of the user interface by using this password. Once connected, the attacker would have full access to all control panel features for the BioFlo 320. VNC traffic is not encrypted.

AnalysisAI

Hard-coded VNC password in the Eppendorf BioFlo 320 bioprocess control system allows any remote attacker who can reach the device on the network to take full control of its user interface without authentication. The flaw (CWE-259) is rated CVSS 9.3 and carries an SSVC technical impact of 'total' with automatable exploitation, though no public exploit has been identified at time of analysis and EPSS is low at 0.10%.

Technical ContextAI

The BioFlo 320 is a benchtop bioreactor/fermentor controller used in biopharmaceutical and laboratory environments, exposing its operator HMI through an embedded VNC (Virtual Network Computing) server for remote access. CWE-259 (Use of Hard-Coded Password) applies because the VNC server ships with a fixed password baked into the firmware that cannot be changed per-deployment, meaning any party who learns the credential (and many such credentials are recovered through firmware reverse engineering or vendor documentation) can authenticate. Compounding the issue, the VNC protocol traffic itself is transmitted unencrypted, so even session content and any subsequent operator interactions are exposed to network observers. The affected CPE is cpe:2.3:a:eppendorf:bioflo_320:*:*:*:*:*:*:*:*, covering all BioFlo 320 versions per the EUVD listing.

RemediationAI

No vendor-released patched version is identified in the available data; the references point to Eppendorf's general software downloads page (https://www.eppendorf.com/software-downloads) and the CISA ICS-MA advisory (https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-146-01), so operators should consult those for any firmware update or vendor-recommended mitigation specific to their unit. As compensating controls, disable the VNC remote access feature on the BioFlo 320 wherever operationally feasible (trade-off: loss of remote HMI for engineers and integrators); place the device on an isolated OT/lab VLAN with explicit allow-listing of operator workstations and deny all other inbound traffic to the VNC port (typically TCP/5900); require operators to reach the HMI only through a jump host with strong authentication and session logging, which also addresses the lack of VNC encryption by tunneling over SSH or a VPN; and block the device from Internet egress and ingress at the perimeter. Monitor for unexpected VNC connections to BioFlo 320 hosts and treat any external-origin connection as an incident.