CVE-2019-6693

medium · 6.5Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added 2025-06-25Remediation due 2025-07-16

Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).

6.5

CVSS

5.8%

EPSS (exploit prob.)

93rd

EPSS percentile

2019-11-21

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-798

Affected products

Vendor	Product	Affected versions
fortinet	fortios	<= 5.6.10
fortinet	fortios	>= 6.0.0, <= 6.0.6
fortinet	fortios	6.2.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2019-6693