CVE-2019-6693

Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability

Exploited in attacks Used by ransomware Medium 6.5 Attack chance: 6.6%

What it is

Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).

CISA: Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: July 16, 2025

Added to the CISA list: June 25, 2025
Published: November 21, 2019
Severity: Medium 6.5 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 6.6% in the top 6.2% of all known vulnerabilities
Weakness: CWE-798
More details: NVD · CVE.org · CISA

All references (1)

https://fortiguard.com/advisory/FG-IR-19-007

More exploited flaws from Fortinet

Added	Vulnerability	Product	Severity	Attack chance
Jul 27, 2026	Exposure of Sensitive Information to an Unauthorized ActorCVE-2025-68686	FortiOS	Medium 5.3	29%
Feb 9, 2024	Out-of-Bound WriteCVE-2024-21762used by ransomware	FortiOS	Critical 9.6	85%
Mar 14, 2023	Path TraversalCVE-2022-41328	FortiOS	Medium 6.5	11%
Dec 13, 2022	Heap-Based Buffer OverflowCVE-2022-42475used by ransomware	FortiOS	Critical 9.3	99.5%
Dec 10, 2021	Arbitrary File DownloadCVE-2021-44168	FortiOS	Low 3.3	0.9%
Nov 3, 2021	Default ConfigurationCVE-2019-5591used by ransomware	FortiOS	Medium 6.5	19%
Nov 3, 2021	SSL VPN Path TraversalCVE-2018-13379used by ransomware	FortiOS	Critical 9.1	>99.9%
Nov 3, 2021	SSL VPN Improper AuthenticationCVE-2020-12812used by ransomware	FortiOS	High 7.5	45%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.