CVEvulnerability

CVE-2019-6693

6.5 MEDIUM Known exploited Published 2019-11-21 Modified 2026-08-04 Official page ↗

CISA Known Exploited Vulnerability

Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability — Fortinet FortiOS

Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.

Added to KEV
2025-06-25
Remediation due
2025-07-16
Ransomware use
Known
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes
https://fortiguard.com/advisory/FG-IR-19-007 ; https://nvd.nist.gov/vuln/detail/CVE-2019-6693
Status
Analyzed
Published
2019-11-21
Last modified
2026-08-04
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
CWE-798

Description

Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).

Affected configurations

• fortinet fortios (<= 5.6.10) • fortinet fortios (>= 6.0.0 <= 6.0.6) • fortinet fortios 6.2.0

Related

Weakness · CWE (1)

  • CWE-798 Use of Hard-coded Credentials weakness

References