Finka software suite exposes hardcoded database credentials
Multiple Finka business applications contain hardcoded Firebird database credentials shared across all installations, allowing local network attackers to read and modify database contents.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska has coordinated the disclosure of CVE-2025-13776, a vulnerability affecting six Finka business software products: Finka-FK, Finka-KPR, Finka-Płace, Finka-Faktura, Finka-Magazyn, and Finka-STW. The vulnerability stems from hardcoded credentials for the Firebird database backend that are identical across all installations of these applications. An attacker positioned on the local network with knowledge of these default credentials can achieve unauthorized access to read and modify database contents.
The vendor has released patches addressing the vulnerability across all affected products. Organizations using these Finka applications should upgrade to the fixed versions immediately: Finka-FK 18.5, Finka-KPR 16.6, Finka-Płace 13.4, Finka-Faktura 18.3, Finka-Magazyn 8.3, and Finka-STW 12.3. The vulnerability was responsibly disclosed by security researcher Wojciech Żebrowski.
Mentioned in this report
Detection guidance
Firebird Database Client Invoked with Hardcoded Credentials on Command Line
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects execution of Firebird database client utilities (isql, gbak, gsec) with username/password supplied directly on the command line, which is how hardcoded/default Firebird credentials embedded in Finka software are typically used to access the backend database. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Firebird Client Utility Executed With Inline Credentials
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \isql.exe
- \gbak.exe
- \gsec.exe
- \qli.exe
creds:
CommandLine|contains:
- '-user '
- '-USER '
- '-pass '
- '-PASSWORD '
- '-p '
condition: selection and creds
falsepositives:
- Legitimate database administration scripts that invoke Firebird command-line tools
with credentials for backup or maintenance tasks
- Automated backup jobs (gbak) scheduled by the Finka application itself using service-account
credentials
level: medium
tags:
- attack.t1552.001
- attack.credential-access
id: 2bf295c7-18cc-5a7b-8150-a1ec780f46e3
status: experimental
author: Vorant
Inbound Connection to Firebird Database Default Port From Unexpected Host
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Flags network connections to the Firebird database service default port (3050) originating from hosts other than the known Finka application server, which may indicate use of hardcoded/default credentials by an attacker on the local network to reach the database directly. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unusual Source Connecting To Firebird Database Port
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 3050
Initiated: 'true'
filter:
SourceIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter
falsepositives:
- Legitimate application servers or reporting tools on the corporate network connecting
to the Firebird database
- Database monitoring or backup agents polling the Firebird port from management subnets
level: low
tags:
- attack.t1078
- attack.initial-access
- attack.lateral-movement
id: 9f1454c0-e628-51a1-a178-27ba4d13c850
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/02/CVE-2025-13776
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs