CVE-2019-6693: Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability
Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.
Other sources
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-6693?
CVE-2019-6693 has a medium severity rating due to the potential exposure of sensitive information.
How do I fix CVE-2019-6693?
To fix CVE-2019-6693, upgrade FortiOS to version 5.6.11 or later, or 6.0.7 or later.
What are the potential impacts of CVE-2019-6693?
The potential impact of CVE-2019-6693 includes unauthorized access to sensitive data such as user passwords in configuration backup files.
Who is affected by CVE-2019-6693?
CVE-2019-6693 affects FortiOS versions 5.6.10 and earlier, 6.0.6 and earlier, and specifically 6.2.0.
Is there a workaround for CVE-2019-6693?
No official workaround has been provided for CVE-2019-6693; updating to a patched version is recommended.