Actively exploited in the wild
Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability
Fortinet - FortiOS · Listed in the CISA KEV since 2025-06-25. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2019-6693
MediumCVSS 6.5KEVExploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).
Risk Assessment
The risk involves potential disclosure of sensitive authentication data, which could lead to unauthorized access to the system and security breaches.
Recommendation
It is recommended to change the default encryption key if possible and secure backup files against unauthorized access.
Original NVD description (English source)
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).