Eppendorf BioFlo 320 bioreactors contain a hard-coded VNC password allowing remote…

26 May 2026 high vulnerability healthcare

Eppendorf BioFlo 320 bioreactors contain a hard-coded VNC password allowing remote attackers full control of the device interface when remote access is enabled.

CISA has disclosed a critical vulnerability (CVE-2026-7251) affecting all versions of the Eppendorf BioFlo 320 bioreactor system used worldwide in healthcare and public health sectors. The vulnerability stems from a hard-coded password in the VNC server implementation that, when remote access is enabled, allows attackers with network access to gain complete control of the user interface and all control panel features. The VNC traffic is transmitted unencrypted, further exposing systems to interception.

While VNC is disabled by default on all shipped systems and can only be enabled locally at the device, organizations that have enabled this feature face significant risk. Eppendorf has responded by releasing version 5.0 software that permanently removes VNC access from the controller and has removed VNC configuration information from all current documentation.

Organizations using affected systems should immediately verify VNC is disabled, restrict VNC setting changes to Admin and Supervisor roles only, and deploy the version 5.0 software update as soon as possible. CISA recommends standard ICS security measures including network isolation, firewall protection, and secure remote access methods such as VPNs. No public exploitation has been reported to CISA at this time.

Mentioned in this report

Vulnerabilities CVE-2026-7251

Detection guidance

VNC Connection Attempt to ICS/Bioreactor Network Segment

ATT&CK T1078

Detects inbound VNC (RFB) connections on port 5900 to hosts on OT/ICS or medical device network segments where VNC should be disabled by default, potentially exploiting the hard-coded credential in Eppendorf BioFlo 320 controllers. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: VNC Connection Attempt to ICS or Medical Device Segment
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 5900
    Protocol: tcp
  filter_known_admin:
    SourceIp|cidr:
    - 10.10.10.0/24
  condition: selection and not filter_known_admin
fields:
- SourceIp
- DestinationIp
- DestinationPort
falsepositives:
- Legitimate remote support sessions using an approved VNC jump host
- Network scanning tools performing authorized asset inventory on ICS segments
level: medium
tags:
- attack.t1078
- attack.t1552.001
id: aaf5be01-6b30-501c-99be-3fd8e7c4b486
status: experimental
author: Vorant

Unencrypted VNC (RFB Protocol) Session to Industrial Control Device

ATT&CK T1552.001

Detects establishment of a VNC RFB protocol session that is unencrypted, matching the exposed remote access path described for the BioFlo 320 hard-coded VNC credential vulnerability; flags plaintext control-plane traffic to devices that should not expose VNC externally. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Plaintext VNC RFB Session to Control System Host
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    DestinationPort: 5900
  encrypted_indicator:
    Protocol: tls
  condition: selection and not encrypted_indicator
falsepositives:
- Internal maintenance VNC sessions to devices not yet migrated to VPN-based remote
  access
- Legacy monitoring tools that connect to VNC ports without TLS by design
level: low
tags:
- attack.t1552.001
- attack.t1078
id: ba124550-54f4-549b-a4b7-725d5f03f83f
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-146-01

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free