CVE-2026-7251 identifies a critical security flaw in the Eppendorf BioFlo 320 where the VNC server uses a hard-coded password (CWE-259). This vulnerability enables unauthenticated remote attackers to access and control the device's user interface if remote access is enabled and the attacker knows the device's network address. The VNC communication is not encrypted, which could facilitate interception or replay attacks. The vulnerability affects all versions of the BioFlo 320. No vendor-provided patch or official remediation guidance is currently available.

An attacker exploiting this vulnerability can gain full control over the BioFlo 320 device remotely without any user interaction or privileges. This includes access to all control panel features, potentially disrupting device operation or causing unauthorized changes. The lack of encryption in VNC traffic further exposes the device to interception risks. The CVSS 4.0 score of 9.3 reflects the critical severity and ease of exploitation over a network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider disabling remote VNC access if possible or isolating the device on a secure network segment to limit exposure. Monitoring network access to the device and restricting access to trusted hosts may reduce risk. Avoid exposing the BioFlo 320 to untrusted networks.