{"id":"CVE-2019-6693","published":"2019-11-21T16:15:13Z","modified":"2026-08-04T05:16:27Z","title":"Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability","vendor":"Fortinet","product":"FortiOS","tier":"core","eol":null,"description":{"text":"Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).","provenance":"source","from":"NVD"},"summary":{"text":"The Fortinet FortiOS vulnerability is a use of a hard-coded cryptographic key that protects sensitive data inside the configuration backup file. An attacker who can access that backup file and knows the hard-coded key can decrypt users' passwords, private key passphrases, and the High Availability password (when set), though not the administrator's password.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:03Z"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.0664,"percentile":0.93845,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2025-06-25","dueDate":"2025-07-16","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://fortiguard.com/advisory/FG-IR-19-007 ; https://nvd.nist.gov/vuln/detail/CVE-2019-6693","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-08-23","exploitedFirstSeen":"2023-08-23","ransomware":true,"evidence":[{"url":"https://stairwell.com/resources/akira-pulling-on-the-chains-of-ransomware/","date":"2023-08-23"},{"url":"https://blog.bushidotoken.net/2023/09/tracking-adversaries-akira-another.html","date":"2023-09-15"},{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2024/10/02/threat-brief-understanding-akira-ransomware","date":"2024-10-02"},{"url":"https://asec.ahnlab.com/ko/86186/","date":"2025-02-10"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-06-25"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/ransomware-ttps-shifting-threat-landscape/","date":"2026-03-16"},{"url":"https://www.group-ib.com/blog/stray-cat-network-edge/","date":"2026-10-21"}],"evidenceTotal":8,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Stray Cat, Open Doors: How k0t Wanders Through the Network Edge","url":"https://otx.alienvault.com/pulse/6ae254cc040814cb0f04c713","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"EbeeOct2026 Pt5","url":"https://otx.alienvault.com/pulse/6ae189b2042138c108f4126b","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Stray Cat, Open Doors: How k0t Wanders Through the Network Edge","url":"https://otx.alienvault.com/pulse/6adba62cf47b44713c9e594b","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Stray Cat, Open Doors: How k0t Wanders Through the Network Edge","url":"https://otx.alienvault.com/pulse/6ad8d8853d4b5de3946bd006","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"}],"provenance":"machine"},"cwes":[{"id":"CWE-798","name":"Use of Hard-coded Credentials"}],"references":[{"url":"https://fortiguard.com/advisory/FG-IR-19-007","tags":["Mitigation","Vendor Advisory"]},{"url":"https://fortiguard.com/advisory/FG-IR-19-007","tags":["Mitigation","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6693","tags":["US Government Resource"]}],"techniques":[{"id":"T1552","name":"Unsecured Credentials","tactics":["credential-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Attacker uses hard-coded key to decrypt backup","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file","start":0,"end":99}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1555","name":"Credentials from Password Stores","tactics":["credential-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Deciphering yields users' passwords and passphrases","mappingType":"primary_impact","evidence":[{"from":"description","quote":"may allow an attacker with access to the backup file to decipher the sensitive data","start":100,"end":183}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-16251","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-16251","exploited":true,"exploitedSince":"2025-06-25","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":4,"skipped":0,"earliest":"2021-12-21","earliestUrl":"https://github.com/gquere/CVE-2019-6693","repos":[{"name":"saladandonionrings/cve-2019-6693","url":"https://github.com/saladandonionrings/cve-2019-6693","stars":30,"created":"2023-12-08"},{"name":"synacktiv/CVE-2020-9289","url":"https://github.com/synacktiv/CVE-2020-9289","stars":11,"created":"2023-06-30"},{"name":"gquere/CVE-2019-6693","url":"https://github.com/gquere/CVE-2019-6693","stars":8,"created":"2021-12-21"},{"name":"Real4XoR/CVE-2019-6693","url":"https://github.com/Real4XoR/CVE-2019-6693","stars":1,"created":"2025-08-26"}]},"first":{"date":"2021-12-21","source":"PoC-in-GitHub","url":"https://github.com/gquere/CVE-2019-6693"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1552"],"provenance":"ai"},{"stage":"primary","techniques":["T1555"],"provenance":"ai"}],"timeline":[{"date":"2019-11-21","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6693","provenance":"source"},{"date":"2021-12-21","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/gquere/CVE-2019-6693","provenance":"source"},{"date":"2023-08-23","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://stairwell.com/resources/akira-pulling-on-the-chains-of-ransomware/","provenance":"source"},{"date":"2025-06-25","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-06-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-16251","provenance":"source"}],"speed":{"daysToPublicExploit":761,"firstExploitFrom":"PoC-in-GitHub","daysToKev":2043},"priority":{"score":76.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1163 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":18.77,"detail":"percentile 0.9385"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"4 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":4.55,"detail":"base score 6.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}