CVE-2019-6693

2019-11-2115:08:05

fortinet

www.cve.org

6.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.6%

JSON

Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users’ passwords (except the administrator’s password), private keys’ passphrases and High Availability password (when set).

CNA Affected

[
  {
    "product": "FortiGate",
    "vendor": "Fortinet",
    "versions": [
      {
        "status": "affected",
        "version": "5.6.9 and below"
      },
      {
        "status": "affected",
        "version": "6.0.5 and below"
      },
      {
        "status": "affected",
        "version": "6.2.0"
      }
    ]
  }
]

References

fortiguard.com/advisory/FG-IR-19-007