CVE-2019-6693

MediumCVSS 6.5/10Known exploited (CISA KEV)Last modified Aug 4, 2026

Description

Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
Fortinet	FortiGate	5.6.9 and below; 6.0.5 and below; 6.2.0

References

https://fortiguard.com/advisory/FG-IR-19-007Mitigation, Vendor Advisory
https://fortiguard.com/advisory/FG-IR-19-007Mitigation, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6693US Government Resource

Timeline

Published: Nov 21, 2019
Last modified: Aug 4, 2026
Added to CISA KEV: Jun 25, 2025
NVD status: Analyzed

Related CVEs from 2019

CVE-2019-66959.8Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below may allow an attacker t CVE-2019-66966.1An improper input validation vulnerability in FortiOS 6.2.1, 6.2.0, 6.0.8 and below until 5.4.0 under admin webUI may allow an attacker to p CVE-2019-66976.1An Improper Neutralization of Input vulnerability affecting FortiGate version 6.2.0 through 6.2.1, 6.0.0 through 6.0.6 in the hostname param CVE-2019-66989.8Use of Hard-coded Credentials vulnerability in FortiRecorder all versions below 2.7.4 may allow an unauthenticated attacker with knowledge o CVE-2019-66995.4An improper neutralization of input vulnerability in Fortinet FortiADC 5.3.3 and earlier may allow an attacker to execute a stored Cross Sit CVE-2019-67006.5An information exposure vulnerability in the external authentication profile form of FortiSIEM 5.2.2 and earlier may allow an authenticated CVE-2019-67025.9The MasterCard Qkr! app before 5.0.8 for iOS has Missing SSL Certificate Validation. NOTE: this CVE only applies to obsolete versions from 2 CVE-2019-67039.8Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauth CVE-2019-67067.5Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to tr CVE-2019-67077.2PHPSHE 1.7 has SQL injection via the admin.php?mod=product&act=state product_id[] parameter.CVE-2019-67087.2PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter.CVE-2019-67108.8Zyxel NBG-418N v2 v1.00(AAXM.4)C0 devices allow login.cgi CSRF.