A hard-coded VNC password on a bioreactor, base score 9.8

MedDevice Cyber Staff · May 26 · 2 min read · Via CISA

The Eppendorf BioFlo 320 bioprocess control station, all versions, uses a hard-coded password on its VNC remote-access interface. ICSMA-26-146-01, CVE-2026-7251, base score 9.8. Reach the interface, use the baked-in password, own the bioreactor, which on a bioprocess controller means the ability to manipulate the process itself. BIO-ISAC reported it, which says the biomanufacturing sector is starting to watch its own instruments the way hospitals watch theirs.

A hard-coded credential is a secret written into the software itself rather than chosen by the operator, identical on every unit that leaves the line. Manufacturers reach for the pattern because it eases assembly and service, a login that always works, but the secret then cannot change without a firmware change, and recovering it once from one device or a leaked build unlocks the whole fleet. A remote-desktop interface sharpens the exposure, since whoever authenticates drives the control screen exactly as an operator at the panel would.

The password is in the firmware, and every unit ships with the same one. No interim mitigation beats network isolation here. Get the VNC interface off any reachable segment and wait for the fix.

A bioprocess controller governs the physical conditions of a living culture, its temperature, its stirring, its feeds and its balance. Command over those settings is command over the batch, and a manipulated run can be spoiled outright or nudged toward material that is subtly wrong while the instrument reports normal operation. In production that reads as lost yield; on a research bench it reads as corrupted results questioned far too late.

Laboratory and manufacturing instruments were long built for a room where anyone at the controls had already been trusted to enter it. A network interface carries that assumption onto a segment where strangers can arrive. A report reaching the public through a sector information-sharing body rather than a lone researcher marks a shift, a sign the field is starting to inspect its own equipment with the scrutiny hospitals learned to apply to theirs.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

The BioFlo 320 bioprocess controller shipped a hard-coded password on its VNC remote-access interface (ICSMA-26-146-01, base score 9.8), so anyone who reaches it controls the bioreactor. Apply the vendor fix and, in the meantime, block the VNC port at the network so the interface is unreachable.

Isolate the VNC interface now. Block or firewall the VNC port so the controller is not reachable from the general network while you remediate.
Apply the vendor remediation. Follow ICSMA-26-146-01 to the fixed firmware or configuration that removes the hard-coded credential.
Replace remote access with authenticated sessions. Where remote control is needed, use an access method with per-user credentials and logging rather than a shared static password.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Contributing

net_remote_access app_user_accounts net_wireless net_wired ctl_therapy ctl_closed_loop sys_firmware_update use_hospital_net

EMB3D

PID-332 PID-3321

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2026-7251 in the Eppendorf BioFlo 320?

The BioFlo 320 bioprocess controller ships a hard-coded password on its VNC remote-access interface. Anyone who can reach that interface gets full control of the controller, which is why it carries a 9.8 base score.

Can it be exploited remotely?

Yes, if the VNC interface is reachable over the network. The credential is fixed in the product, so no guessing or brute force is needed once an attacker has a network path to the device.

What should a lab or manufacturer do about it?

Restrict access to the VNC interface and put the device behind network segmentation, then apply the remediation in ICSMA-26-146-01. Rotating the password is not enough on its own because it is built into the product.

← Back to Vulnerabilities