CVE-2025-13776
Published: 24 February 2026
Summary
CVE-2025-13776 is a high-severity Use of Hard-coded Credentials (CWE-798) vulnerability in Finka Finka-Faktura. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked at the 4.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 IA-5 (Authenticator Management) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-13776 is a vulnerability in multiple Finka programs, including Finka-FK, Finka-KPR, Finka-Płace, Finka-Faktura, Finka-Magazyn, and Finka-STW, stemming from the use of hard-coded Firebird database credentials shared across all instances of the software. Classified under CWE-798 (Use of Hard-coded Credentials), it allows unauthorized access to database contents. The issue carries a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) and was published on 2026-02-24.
A malicious attacker on the local network who knows the default credentials can exploit this vulnerability to read and edit database content. Exploitation requires local access, low attack complexity, and low privileges, with no user interaction needed, leading to high confidentiality and integrity impacts but no availability disruption.
The vulnerability has been fixed in the following versions: Finka-FK 18.5, Finka-KPR 16.6, Finka-Płace 13.4, Finka-Faktura 18.3, Finka-Magazyn 8.3, and Finka-STW 12.3. Additional mitigation details are available in the advisory at https://cert.pl/en/posts/2026/01/CVE-2025-13776 and on the vendor site at https://finka.pl/.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208095
- 🇵🇱 CERT-PL: cert.pl
Vulnerability details
Multiple Finka programs use hard-coded Firebird database credentials (shared across all instances of this software). A malicious attacker in local network who knows default credentials is able to read and edit database content. This vulnerability has been fixed in version:…
more
Finka-FK 18.5, Finka-KPR 16.6, Finka-Płace 13.4, Finka-Faktura 18.3, Finka-Magazyn 8.3, Finka-STW 12.3
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Hard-coded DB credentials directly enable credential abuse (T1552.001) for unauthorized DB access (T1213.006) and modification (T1565.001).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
IA-5 requires secure authenticator management and explicitly prohibits hard-coded or default credentials, directly blocking the shared Firebird passwords that enable this CVE.
AC-3 enforces access decisions based on validated identity and authorization, preventing the unauthorized database reads/edits that occur when default credentials are known.
AC-6 limits privileges assigned to any account, reducing the impact of the hard-coded Firebird credentials even if they become known on the local network.