Servers and applications
CVE-2019-6693
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).
Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 25 Jun 2025.
- Severity
- Medium 6.5
- Published
- 21 Nov 2019
- Last changed
- 4 Aug 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 6.6% in the next 30 daysHigher than 93% of CVEs. EPSS by FIRST, 10 Nov 2026
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
Fortinet FortiOSServers and applications · cpe:o:fortinet:fortios |
|
Known exploited
- CISA name
- Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Due for US agencies
- 16 Jul 2025
- Used in ransomware
- Yes, known