CVE-2019-6693

MediumCVSS 6.5/10Known exploited (CISA KEV)Last modified Aug 4, 2026

Description

Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published
Nov 21, 2019
Last modified
Aug 4, 2026
Added to CISA KEV
Jun 25, 2025
NVD status
Analyzed

Related CVEs from 2019

CVE-2019-66959.8Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below may allow an attacker tCVE-2019-66966.1An improper input validation vulnerability in FortiOS 6.2.1, 6.2.0, 6.0.8 and below until 5.4.0 under admin webUI may allow an attacker to pCVE-2019-66976.1An Improper Neutralization of Input vulnerability affecting FortiGate version 6.2.0 through 6.2.1, 6.0.0 through 6.0.6 in the hostname paramCVE-2019-66989.8Use of Hard-coded Credentials vulnerability in FortiRecorder all versions below 2.7.4 may allow an unauthenticated attacker with knowledge oCVE-2019-66995.4An improper neutralization of input vulnerability in Fortinet FortiADC 5.3.3 and earlier may allow an attacker to execute a stored Cross SitCVE-2019-67006.5An information exposure vulnerability in the external authentication profile form of FortiSIEM 5.2.2 and earlier may allow an authenticated CVE-2019-67025.9The MasterCard Qkr! app before 5.0.8 for iOS has Missing SSL Certificate Validation. NOTE: this CVE only applies to obsolete versions from 2CVE-2019-67039.8Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthCVE-2019-67067.5Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to trCVE-2019-67077.2PHPSHE 1.7 has SQL injection via the admin.php?mod=product&act=state product_id[] parameter.CVE-2019-67087.2PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter.CVE-2019-67108.8Zyxel NBG-418N v2 v1.00(AAXM.4)C0 devices allow login.cgi CSRF.