Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability
Fortinet — FortiGate
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).
6.5
5.6%
Vector breakdown
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Published
- Nov 21, 2019
- Modified
- Aug 4, 2026
- Added to KEV
- Jun 25, 2025
- Federal patch due
- Jul 16, 2025
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Weakness classification
Affected packages
Proof-of-concept & exploitation references
4 foundWeaponization
Public repositories whose name or description references CVE-2019-6693, found via a live GitHub search at request time. These are community-sourced signals, not a verified working exploit - cross-check each one before relying on it, and treat higher star counts and recent activity as (weak) corroboration, not proof.
- saladandonionrings/cve-2019-6693★ 30
An authorized remote user with access or knowledge of the standard encryption key can gain access and decrypt the FortiOS backup files and all non-administator passwords, private keys and High Availability passwords.
updated Sep 25, 2026
- synacktiv/CVE-2020-9289★ 11
Decrypt reversible secrets encrypted using the default hardcoded key related to CVE-2020-9289 on FortiAnalyzer/FortiManager (the only difference with CVE-2019-6693 is the encryption routine).
updated Jan 24, 2025
- gquere/CVE-2019-6693★ 8
Decrypt FortiGate configuration secrets
updated Jun 26, 2026
- Real4XoR/CVE-2019-6693★ 1
updated Jun 4, 2026
References
Frequently asked questions
What is CVE-2019-6693?
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).
How severe is CVE-2019-6693?
CVE-2019-6693 has a CVSS base score of 6.5 out of 10 (CVSS 3.1).
Is CVE-2019-6693 actively exploited in the wild?
Yes. CVE-2019-6693 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added Jun 25, 2025, meaning CISA has confirmed evidence of active exploitation. It is also flagged as used in ransomware campaigns.
What is the EPSS score for CVE-2019-6693?
5.6% - meaning FIRST.org's EPSS model estimates a 5.6% probability this vulnerability will be exploited in the wild within 30 days (92% percentile among all scored CVEs).
Is there exploit tooling available for CVE-2019-6693?
We found 4 public GitHub repositories referencing CVE-2019-6693, though none matched a known Nuclei template or Metasploit module at last check. Review each one before relying on it - see the proof-of-concept section above.
What type of vulnerability is CVE-2019-6693?
CVE-2019-6693 is classified under CWE-798 (CWE-798 Use of Hard-coded Credentials).
Cross-checked against
Impactr finds and proves whether CVE-2019-6693 - or flaws like it - are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.
Join the waitlist