CVE-2019-6693: Hard-Coded Cryptographic Key in FortiOS

CVE-2019-6693 describes the use of a hard-coded cryptographic key in FortiOS to cipher configuration backup files. Anyone accessing the backup file can decipher sensitive data including user passwords (except admin), private key passphrases and High Availability passwords. FortiOS is widely deployed in enterprise environments for perimeter security appliances and central security functions.

The vulnerability has CVSS 6.5 (medium) according to the declared rating. Published on NVD on November 21, 2019, it has been documented for over six years. A signal on GitHub was registered on November 7, 2026, indicating the existence of public repositories claiming to contain exploit-related material. This recent signal raises awareness of a vulnerability potentially overlooked by FortiOS infrastructure administrators.

FortiOS administrators must immediately evaluate physical and logical access to backup files. If backups are not stored in protected environments with strict access controls, they represent a concrete risk of exposure to critical credentials. Available data does not contain information on official patches. Apply zero trust principles to backup archives and verify access policies, both on-premises and remotely.