LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

A hard-coded VNC password on a bioreactor, base score 9.8

MedDevice Cyber Staff · May 26 · 2 min read · Via CISA

The Eppendorf BioFlo 320 bioprocess control station, all versions, uses a hard-coded password on its VNC remote-access interface. ICSMA-26-146-01, CVE-2026-7251, base score 9.8. Reach the interface, use the baked-in password, own the bioreactor, which on a bioprocess controller means the ability to manipulate the process itself. BIO-ISAC reported it, which says the biomanufacturing sector is starting to watch its own instruments the way hospitals watch theirs.

The password is in the firmware, and every unit ships with the same one. No interim mitigation beats network isolation here. Get the VNC interface off any reachable segment and wait for the fix.

Remediation Desk

The BioFlo 320 bioprocess controller shipped a hard-coded password on its VNC remote-access interface (ICSMA-26-146-01, base score 9.8), so anyone who reaches it controls the bioreactor. Apply the vendor fix and, in the meantime, block the VNC port at the network so the interface is unreachable.

Isolate the VNC interface now. Block or firewall the VNC port so the controller is not reachable from the general network while you remediate.
Apply the vendor remediation. Follow ICSMA-26-146-01 to the fixed firmware or configuration that removes the hard-coded credential.
Replace remote access with authenticated sessions. Where remote control is needed, use an access method with per-user credentials and logging rather than a shared static password.

Sources

CISA ↗

Questions & Answers

What is CVE-2026-7251 in the Eppendorf BioFlo 320?

The BioFlo 320 bioprocess controller ships a hard-coded password on its VNC remote-access interface. Anyone who can reach that interface gets full control of the controller, which is why it carries a 9.8 base score.

Can it be exploited remotely?

Yes, if the VNC interface is reachable over the network. The credential is fixed in the product, so no guessing or brute force is needed once an attacker has a network path to the device.

What should a lab or manufacturer do about it?

Restrict access to the VNC interface and put the device behind network segmentation, then apply the remediation in ICSMA-26-146-01. Rotating the password is not enough on its own because it is built into the product.

← Back to Vulnerabilities