CISA Advisory: Eppendorf BioFlo 320 Bioreactor Hardcoded Credentials (ICSMA-26-146-01)

Vulnerability Overview Vulnerability Name: Eppendorf BioFlo 320 Release Date: May 26, 2026 Alert Code: ICSMA-26-146-01 CVSS Score: v3 9.8 Vulnerability Type: Use of Hard-coded Password Impact: Successful exploitation of this vulnerability could allow an attacker to gain full access to the bioreactor's functionality and data. Affected Scope Affected Versions: All versions of the BioFlo 320 Bioreactor Critical Infrastructure Sector: Healthcare and Public Health Countries/Regions of Deployment: Worldwide Company Headquarters Location: Germany Remediation Recommended Practices: - Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet. - Place control system networks and remote devices behind firewalls and isolate them from the business network. - When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), and ensure VPNs are updated to the latest version. - Conduct proper impact analysis and risk assessment prior to deploying defensive measures. - Implement recommended cybersecurity strategies to proactively defend ICS assets. - Follow internal procedures for reporting suspected malicious activity and report findings to CISA for tracking and correlation analysis. - Do not click links or open unsolicited attachments in emails. - Refer to resources for avoiding email scams and social engineering attacks. Additional Information Related Topics: Industrial Control Systems Vulnerabilities, Industrial Control Systems Acknowledgments: BIO-ISAC reported this vulnerability to CISA. Revision History: Initial release date May 26, 2026, Version 1, Initial Release. Tags Industry: Healthcare and Public Health Topics: Industrial Control Systems Vulnerabilities, Industrial Control Systems Related Links Related Advisories: - Grassroots DICOM (GDCM) - ZOLL ePCR IOS Mobile Application - WHILL Model C2 Electric Wheelchairs and Model F Power Chairs (Update A) - Grassroots DICOM (GDCM) Feedback Please share your thoughts. We recently updated our anonymous product survey and welcome feedback. Legal Notice and Terms of Use This product is subject to this notice and the Privacy and Use Policy. Contact Information CISA Central: 1-844-Say-CISA, contact@cisa.dhs.gov Footer CISA.gov is the official website of the U.S. Department of Homeland Security. Links to About CISA, Budget and Performance, DHS.gov, FOIA Requests, No FEAR Act, Office of Inspector General, Privacy Policy, Subscribe, White House, USA.gov, Website Feedback, etc.

Goal Reached Thanks to every supporter — we hit 100%!

CISA Advisory: Eppendorf BioFlo 320 Bioreactor Hardcoded Credentials (ICSMA-26-146-01)