# Finka software suite exposes hardcoded database credentials

Published: 2026-02-24 · Severity: medium
Canonical: https://vorant.io/reports/83c65707-6c65-54a9-9c37-8137f911f45a/finka-software-suite-exposes-hardcoded-database-credentials

> Multiple Finka business applications contain hardcoded Firebird database credentials shared across all installations, allowing local network attackers to read and modify database contents.

CERT Polska has coordinated the disclosure of CVE-2025-13776, a vulnerability affecting six Finka business software products: Finka-FK, Finka-KPR, Finka-Płace, Finka-Faktura, Finka-Magazyn, and Finka-STW. The vulnerability stems from hardcoded credentials for the Firebird database backend that are identical across all installations of these applications. An attacker positioned on the local network with knowledge of these default credentials can achieve unauthorized access to read and modify database contents.

The vendor has released patches addressing the vulnerability across all affected products. Organizations using these Finka applications should upgrade to the fixed versions immediately: Finka-FK 18.5, Finka-KPR 16.6, Finka-Płace 13.4, Finka-Faktura 18.3, Finka-Magazyn 8.3, and Finka-STW 12.3. The vulnerability was responsibly disclosed by security researcher Wojciech Żebrowski.

## Mentioned in this report

- Vulnerabilities: CVE-2025-13776

## Detection guidance (public sample)

### Firebird Database Client Invoked with Hardcoded Credentials on Command Line

ATT&CK: T1552.001

Detects execution of Firebird database client utilities (isql, gbak, gsec) with username/password supplied directly on the command line, which is how hardcoded/default Firebird credentials embedded in Finka software are typically used to access the backend database. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Firebird Client Utility Executed With Inline Credentials
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
    - \isql.exe
    - \gbak.exe
    - \gsec.exe
    - \qli.exe
  creds:
    CommandLine|contains:
    - '-user '
    - '-USER '
    - '-pass '
    - '-PASSWORD '
    - '-p '
  condition: selection and creds
falsepositives:
- Legitimate database administration scripts that invoke Firebird command-line tools
  with credentials for backup or maintenance tasks
- Automated backup jobs (gbak) scheduled by the Finka application itself using service-account
  credentials
level: medium
tags:
- attack.t1552.001
- attack.credential_access
id: 2bf295c7-18cc-5a7b-8150-a1ec780f46e3
status: experimental
author: Vorant
```

### Inbound Connection to Firebird Database Default Port From Unexpected Host

ATT&CK: T1078

Flags network connections to the Firebird database service default port (3050) originating from hosts other than the known Finka application server, which may indicate use of hardcoded/default credentials by an attacker on the local network to reach the database directly. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Unusual Source Connecting To Firebird Database Port
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 3050
    Initiated: 'true'
  filter:
    SourceIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and not filter
falsepositives:
- Legitimate application servers or reporting tools on the corporate network connecting
  to the Firebird database
- Database monitoring or backup agents polling the Firebird port from management subnets
level: low
tags:
- attack.t1078
- attack.initial_access
- attack.lateral_movement
id: 9f1454c0-e628-51a1-a178-27ba4d13c850
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/02/CVE-2025-13776

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/83c65707-6c65-54a9-9c37-8137f911f45a/finka-software-suite-exposes-hardcoded-database-credentials.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup