Eppendorf BioFlo 320 hard-coded VNC password enables remote control
Eppendorf BioFlo 320 bioreactors contain a hard-coded VNC password allowing remote attackers full control of the device interface when remote access is enabled.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA has disclosed a critical vulnerability (CVE-2026-7251) affecting all versions of the Eppendorf BioFlo 320 bioreactor system used worldwide in healthcare and public health sectors. The vulnerability stems from a hard-coded password in the VNC server implementation that, when remote access is enabled, allows attackers with network access to gain complete control of the user interface and all control panel features. The VNC traffic is transmitted unencrypted, further exposing systems to interception.
While VNC is disabled by default on all shipped systems and can only be enabled locally at the device, organizations that have enabled this feature face significant risk. Eppendorf has responded by releasing version 5.0 software that permanently removes VNC access from the controller and has removed VNC configuration information from all current documentation.
Organizations using affected systems should immediately verify VNC is disabled, restrict VNC setting changes to Admin and Supervisor roles only, and deploy the version 5.0 software update as soon as possible. CISA recommends standard ICS security measures including network isolation, firewall protection, and secure remote access methods such as VPNs. No public exploitation has been reported to CISA at this time.
Mentioned in this report
Detection guidance
VNC Connection Attempt to ICS/Bioreactor Network Segment
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects inbound VNC (RFB) connections on port 5900 to hosts on OT/ICS or medical device network segments where VNC should be disabled by default, potentially exploiting the hard-coded credential in Eppendorf BioFlo 320 controllers. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: VNC Connection Attempt to ICS or Medical Device Segment
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 5900
Protocol: tcp
filter_known_admin:
SourceIp|cidr:
- 10.10.10.0/24
condition: selection and not filter_known_admin
fields:
- SourceIp
- DestinationIp
- DestinationPort
falsepositives:
- Legitimate remote support sessions using an approved VNC jump host
- Network scanning tools performing authorized asset inventory on ICS segments
level: medium
tags:
- attack.t1078
- attack.t1552.001
id: aaf5be01-6b30-501c-99be-3fd8e7c4b486
status: experimental
author: Vorant
Unencrypted VNC (RFB Protocol) Session to Industrial Control Device
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects establishment of a VNC RFB protocol session that is unencrypted, matching the exposed remote access path described for the BioFlo 320 hard-coded VNC credential vulnerability; flags plaintext control-plane traffic to devices that should not expose VNC externally. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Plaintext VNC RFB Session to Control System Host
logsource:
category: network_connection
product: linux
detection:
selection:
DestinationPort: 5900
encrypted_indicator:
Protocol: tls
condition: selection and not encrypted_indicator
falsepositives:
- Internal maintenance VNC sessions to devices not yet migrated to VPN-based remote
access
- Legacy monitoring tools that connect to VNC ports without TLS by design
level: low
tags:
- attack.t1552.001
- attack.t1078
id: ba124550-54f4-549b-a4b7-725d5f03f83f
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-146-01
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs