CVE-2026-7251

CriticalCVSS 9.8/10Last modified Jul 24, 2026

Description

Eppendorf BioFlo 320 is vulnerable due to VNC server using a hard-coded password. If a remote attacker knows the network address of any BioFlo 320 model with remote access enabled, they can gain full control of the user interface by using this password. Once connected, the attacker would have full access to all control panel features for the BioFlo 320. VNC traffic is not encrypted.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-259

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
May 26, 2026
Last modified
Jul 24, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-725109.0The "supplier_no" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection.CVE-2026-72528.1The WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance plugin for WordPress is vulnerable to arCVE-2026-725226.2libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates dCVE-2026-725248.8Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data theyCVE-2026-725269.9A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotaCVE-2026-725285.1"Handmade Marketplace App - Creema" provided by CREEMA LTD. contains an open redirect vulnerability. When accessing a specially crafted URL,CVE-2026-725299.8A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X tCVE-2026-72536.0IBM Sterling B2B Integrator and IBM Sterling File Gateway are vulnerable to SQL injection. A privileged user could send specially crafted SQCVE-2026-725309.0A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X tCVE-2026-725315.4Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper acceCVE-2026-725325.4Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access chCVE-2026-725338.8An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy autho