CVE-2019-6693 — Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability
CVE-2019-6693: Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability
CISA Known Exploited Vulnerability (KEV)
| Vendor / project | Fortinet |
| Product | FortiOS |
| Date added | 2025-06-25 |
| Due date | 2025-07-16 |
| Ransomware campaign use | Known |
Description
Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.
Required action (CISA)
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes
https://fortiguard.com/advisory/FG-IR-19-007 ; https://nvd.nist.gov/vuln/detail/CVE-2019-6693
References
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2019-6693
- KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog