Eppendorf BioFlo 320 is vulnerable because its VNC server uses a hard‑coded password. A remote attacker who knows the device’s network address and finds remote access enabled can log in with this password and gain full control of the user interface, giving access to all control panel features. VNC traffic is not encrypted, allowing attackers to intercept or alter data in transit.

The affected product is the Eppendorf BioFlo 320. All units shipped with VNC disabled by default, and the feature can only be enabled locally at the tower. Any BioFlo 320 that has VNC enabled is vulnerable.

The CVSS score is 9.3, indicating critical severity. Although the EPSS score is <1%, the presence of a hard‑coded password and lack of encryption suggest that exploitation remains feasible, but the low EPSS score indicates a relatively low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, but the attack vector is remote network access, and an attacker could exploit it without needing privileged credentials or local access.