FortiOS
CVE-2019-6693: FortiOS Use of Hard-Coded Credentials
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| FortiGate 5.6 | See the advisory |
| FortiGate 6.0 | See the advisory |
| FortiGate 6.2 | See the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).
Exploitation
CISA lists this CVE as exploited in the wild since 25 Jun 2025, including in ransomware campaigns.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 10 Oct 2026.