CVE Intelligence
Analysis AI-assisted

CVE-2026-7251: Eppendorf BioFlo 320 Hard-coded VNC Password

CVE-2026-7251 describes a hard-coded password in the VNC server of the Eppendorf BioFlo 320. According to the record, a remote attacker who knows the network address of a model with remote access enabled could gain full control of the user interface. The record rates it critical (CVSS v3.1 9.8, CVSS v4.0 9.3), but lists no affected or fixed versions and no confirmed exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-7251 affects the Eppendorf BioFlo 320. The record states that its VNC server uses a hard-coded password. The issue is classified as CWE-259, Use of Hard-coded Password. The CNA is ICS-CERT, and the record references CISA ICS medical advisory ICSMA-26-146-01.

Impact

  • According to the record, a remote attacker who knows the network address of a BioFlo 320 with remote access enabled could use the hard-coded password to take control of the user interface.
  • The record states the attacker would then have full access to all control panel features.
  • The record states VNC traffic is not encrypted, which the record does not further analyze.
  • The CVSS v3.1 base score is 9.8 (critical) and the CVSS v4.0 score is 9.3, both assigned by ICS-CERT.

Affected products and versions

  • The product is the Eppendorf BioFlo 320. The record does not list affected software or firmware versions, so the affected version range is unknown.
  • Models with remote access disabled are not described as affected by the record.
  • Consult the vendor advisory and the Eppendorf software downloads page to determine which versions apply to your installation.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record consulted.
  • No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • The record lists no fixed version. This does not mean no fix exists; check the CISA advisory ICSMA-26-146-01 and the vendor download page for updates.
  • Disable remote access on BioFlo 320 devices unless it is strictly required.
  • Restrict network reachability of the device to trusted management segments and place it behind segmentation or firewall controls.
  • Use VPN or other encrypted tunnels for remote administration instead of exposing unencrypted VNC traffic.
  • Change the default credential where the vendor allows it, and review vendor guidance on secure configuration.

Detection guidance

  • Inventory all BioFlo 320 devices and identify any with remote access enabled.
  • Monitor network traffic to the device for unexpected remote sessions from untrusted sources.
  • Review logs on firewalls and gateways for inbound VNC connections to laboratory or control equipment.

Limitations of the available information

  • The record does not list affected or fixed versions, so exposure cannot be determined from it alone.
  • The exact remote access configuration and the VNC implementation details are not described in the record.
  • The record's EPSS data is provided, but its exploitation likelihood should be interpreted with caution given the limited context.
  • The advisory and vendor pages were referenced but their full contents were not part of the record analyzed here.

Frequently asked questions

What is CVE-2026-7251?

It is a record describing a hard-coded password in the VNC server of the Eppendorf BioFlo 320, which the record says could give a remote attacker control of the user interface.

Is this vulnerability known to be exploited?

The CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation in the wild appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.