CVE-2019-6693

MEDIUMCISA KEV

6.5

Description

Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).

Details CVE

Score CVSS v3.16.5

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisLOW

Interaction utilisateurNONE

Publie11/21/2019

Derniere modification10/24/2025

Sourcekev

Observations honeypot0

CISA KEV

FournisseurFortinet

ProduitFortiOS

Nom vulnerabiliteFortinet FortiOS Use of Hard-Coded Credentials Vulnerability

Date ajout KEV2025-06-25

Date limite remediation2025-07-16

Utilise dans ransomwareKnown

Produits affectes

fortinet:fortios

Faiblesses (CWE)

CWE-798CWE-798

References

https://fortiguard.com/advisory/FG-IR-19-007(psirt@fortinet.com)

https://fortiguard.com/advisory/FG-IR-19-007(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6693(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.