PT-2026-21765 · Finka-Kpr+3 · Finka-Kpr+5

Wojciech Żebrowski · Publicado 2026-02-24 · Atualizado 2026-02-25 · CVE-2025-13776

Positive Technologies (AI Summary)

CVSS v4.0

8.6

Alta

Vetor base

AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Finka-FK versions prior to 18.5 Finka-KPR versions prior to 16.6 Finka-Płace versions prior to 13.4 Finka-Faktura versions prior to 18.3 Finka-Magazyn versions prior to 8.3 Finka-STW versions prior to 12.3

Description The Finka software suite contains hard-coded Firebird database credentials that are shared across all instances. An attacker on the local network with knowledge of these default credentials can read and modify the database content.

Recommendations Update Finka-FK to version 18.5 or later. Update Finka-KPR to version 16.6 or later. Update Finka-Płace to version 13.4 or later. Update Finka-Faktura to version 18.3 or later. Update Finka-Magazyn to version 8.3 or later. Update Finka-STW to version 12.3 or later.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2025-13776

Produtos afetados

Finka-Fk

Finka-Faktura

Finka-Kpr

Finka-Magazyn

Finka-Płace

Finka-Stw

Referências · 7

• https://twitter.com/VulmonFeeds/status/2026402158652932384 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-13776 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-13776 · Aviso do Fabricante
• https://finka.pl · Nota
• https://cert.pl/en/posts/2026/01/CVE-2025-13776 · Nota
• https://twitter.com/CVEnew/status/2026676453702774927 · Publicação no Twitter
• https://t.me/CVEtracker/45631 · Publicação no Telegram