Hard-coded database credentials in Finka software
Priority LOW 36CWE-798Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-798.
Summary
Multiple Finka programs use hard-coded Firebird database credentials (shared across all instances of this software). A malicious attacker in local network who knows default credentials is able to read and edit database content. This vulnerability has been fixed in version: Finka-FK 18.5, Finka-KPR 16.6, Finka-Płace 13.4, Finka-Faktura 18.3, Finka-Magazyn 8.3, Finka-STW 12.3
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00142 3rd percentileScored 2026-11-07
Fix Fixed Finka-FK (TIK-SOFT): 18.5Finka-KPR (TIK-SOFT): 16.6+4 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TIK-SOFT | Finka-FK | before 18.5 | 18.5 | Patch available | CNA |
| TIK-SOFT | Finka-KPR | before 16.6 | 16.6 | Patch available | CNA |
| TIK-SOFT | Finka-Płace | before 13.4 | 13.4 | Patch available | CNA |
| TIK-SOFT | Finka-Faktura | before 18.3 | 18.3 | Patch available | CNA |
| TIK-SOFT | Finka-Magazyn | before 8.3 | 8.3 | Patch available | CNA |
| TIK-SOFT | Finka-STW | before 12.3 | 12.3 | Patch available | CNA |
- Finka-FK VendorTIK-SOFT Affected before 18.5 Fixed in 18.5 Patch available CNA
- Finka-KPR VendorTIK-SOFT Affected before 16.6 Fixed in 16.6 Patch available CNA
- Finka-Płace VendorTIK-SOFT Affected before 13.4 Fixed in 13.4 Patch available CNA
- Finka-Faktura VendorTIK-SOFT Affected before 18.3 Fixed in 18.3 Patch available CNA
- Finka-Magazyn VendorTIK-SOFT Affected before 8.3 Fixed in 8.3 Patch available CNA
- Finka-STW VendorTIK-SOFT Affected before 12.3 Fixed in 12.3 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:finka:finka-faktura:*:*:*:*:*:*:*:* | before 18.3 | Vulnerable | Finka |
| cpe:2.3:a:finka:finka-fk:*:*:*:*:*:*:*:* | before 18.5 | Vulnerable | Finka |
| cpe:2.3:a:finka:finka-kpr:*:*:*:*:*:*:*:* | before 16.6 | Vulnerable | Finka |
| cpe:2.3:a:finka:finka-magazyn:*:*:*:*:*:*:*:* | before 8.3 | Vulnerable | Finka |
| cpe:2.3:a:finka:finka-place:*:*:*:*:*:*:*:* | before 13.4 | Vulnerable | Finka |
| cpe:2.3:a:finka:finka-stw:*:*:*:*:*:*:*:* | before 12.3 | Vulnerable | Finka |
- cpe:2.3:a:finka:finka-faktura:*:*:*:*:*:*:*:* Versions before 18.3 Vulnerable ·Finka
- cpe:2.3:a:finka:finka-fk:*:*:*:*:*:*:*:* Versions before 18.5 Vulnerable ·Finka
- cpe:2.3:a:finka:finka-kpr:*:*:*:*:*:*:*:* Versions before 16.6 Vulnerable ·Finka
- cpe:2.3:a:finka:finka-magazyn:*:*:*:*:*:*:*:* Versions before 8.3 Vulnerable ·Finka
- cpe:2.3:a:finka:finka-place:*:*:*:*:*:*:*:* Versions before 13.4 Vulnerable ·Finka
- cpe:2.3:a:finka:finka-stw:*:*:*:*:*:*:*:* Versions before 12.3 Vulnerable ·Finka
Remediation
- Fix · CNA Finka-FK (TIK-SOFT) Fixed in 18.5
- Fix · CNA Finka-KPR (TIK-SOFT) Fixed in 16.6
- Fix · CNA Finka-Płace (TIK-SOFT) Fixed in 13.4
- Fix · CNA Finka-Faktura (TIK-SOFT) Fixed in 18.3
- Fix · CNA Finka-Magazyn (TIK-SOFT) Fixed in 8.3
- Fix · CNA Finka-STW (TIK-SOFT) Fixed in 12.3
Timeline
- 2026-10-02 Threatist record created from CVE-2025-13776
- 2026-10-03 Alias added: GHSA-hjg3-g5mq-q5qp
References
Other 1
Sources
- CVE-2025-13776 · CVE Program
- CVE-2025-13776 · NVD
- FIRST EPSS
- GHSA-hjg3-g5mq-q5qp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences