Vulnerability Intelligence Report
Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability
CVE-2019-6693
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).
CISA KEV
SSVC: Active Exploitation
CVSS Base Score
6.5
MEDIUM
Exploitability:2.9
Impact Score:3.6
EPSS Probability:5.66%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-798 ↗CWE-798 Use of Hard-coded Credentials
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Fortinet | FortiGate | 5.6.9 and below (affected), 6.0.5 and below (affected), 6.2.0 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Fortinet, Inc. · Vendor · USA |
| Reserved | 2019-01-23T00:00:00 |
| Published | 2019-11-21T15:08:05 |
| Last Updated | 2026-08-04T03:55:51 |
Community Chatter & Buzz