{"id":"CVE-2019-6693","kind":"vulnerability","aliases":["CVE-2019-6693"],"related":[],"title":"fortinet fortios: Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an…","description":"Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).","summary":"Fortinet FortiOS contains a hard-coded cryptographic key used to encrypt configuration backup files. An attacker who knows the key can decrypt a backup and read sensitive data stored in it.","severity":"high","cvss":6.5,"epss":null,"exploited":true,"exploited_at":"2025-06-25T00:00:00+00:00","products":[{"name":"Fortinet FortiOS","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":[],"affected":"<= 5.6.10","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":[],"affected":">= 6.0.0, <= 6.0.6","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":[],"affected":"= 6.2.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","fortinet","fortios","infrastructure","ransomware","self-hosted"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the mitigation per Fortinet's vendor instructions, or discontinue use of the product if mitigations are unavailable (per CISA required action). Affected and fixed versions: unknown","status":"open","published_at":"2019-11-21T16:15:13+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:46:51+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:46:51Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigation per Fortinet's vendor instructions, or discontinue use of the product if mitigations are unavailable (per CISA required action). Affected and fixed versions: unknown","reach":"unknown","summary":"Fortinet FortiOS contains a hard-coded cryptographic key used to encrypt configuration backup files. An attacker who knows the key can decrypt a backup and read sensitive data stored in it.","category":"infrastructure","who_cares":["fortios","fortinet","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker decrypts configuration backups and reads stored sensitive data, such as credentials","analyst_note":"Find Fortinet's advisory for CVE-2019-6693 to get affected versions, fixed versions, and how to check whether a backup or device is exposed.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00044,"input_tokens":2565,"output_tokens":366,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2019':23A,26A '-6693':24A,27A 'access':96C 'administr':123C 'aforement':115C 'allow':21A,92C 'attack':60B,94C 'avail':131C 'backup':18A,57B,68B,89C,99C 'cipher':12A,83C 'code':8A,50B,79C,112C 'configur':17A,56B,88C 'contain':46B 'cryptograph':9A,51B,80C 'cve':22A,25A 'data':14A,72B,85C,105C,117C 'deciph':102C 'decrypt':66B 'encrypt':55B 'except':121C 'exploit':36B 'file':19A,58B,90C,100C 'fortinet':1A,28A,30A,32A,34A,37B,44B 'fortio':2A,16A,38B,45B,87C 'fortios':29A,31A,33A,35A 'hard':7A,49B,78C,111C 'hard-cod':6A,48B,77C,110C 'high':130C 'host':43B 'includ':118C 'infrastructur':39B 'key':10A,52B,64B,81C,113C,127C 'know':62B 'knowledg':107C 'may':20A,91C 'passphras':128C 'password':120C,125C,132C 'privat':126C 'ransomwar':40B 'read':70B 'self':42B 'self-host':41B 'sensit':13A,71B,84C,104C,116C 'set':134C 'store':73B 'use':3A,53B,74C 'user':119C 'via':106C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-11-21T16:15:13+00:00","kev":{"dateAdded":"2025-06-25","dueDate":"2025-07-16","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-6693","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-6693","severity":null,"published_at":"2025-06-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:14+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-6693","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6693","severity":null,"published_at":"2019-11-21T16:15:13+00:00","modified_at":"2026-08-04T05:16:27+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}