IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
6.5Mittel KEV In Ransomware genutzt

CVE-2019-6693Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability

Fortinet FortiGate Veröffentlicht: (vor 6 Jahren)

Bekannt ausgenutzt — Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability

CISA hat am 25.06.2025 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 16.07.2025.

Erforderliche Maßnahme: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://fortiguard.com/advisory/FG-IR-19-007 ; https://nvd.nist.gov/vuln/detail/CVE-2019-6693

Beschreibung

Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).

Schwachstellentyp (CWE): CWE-798

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
Fortinet FortiGate 5.6.9 and below, 6.0.5 and below, 6.2.0
fortinet fortios ≤ 5.6.10

Referenzen und Patches

CPE-Treffer (NVD) (3)
  • cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≤ 5.6.10
  • cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.0.0 ≤ 6.0.6
  • cpe:2.3:o:fortinet:fortios:6.2.0:*:*:*:*:*:*:*

Neue CVEs im selben Produkt — Fortinet (all products)

9.1Kritisch
CVE-2026-126229
Fortinet FortiManager; Fortinet FortiAnalyzer; Fortinet FortiManager Cloud; Fortinet FortiAnalyzer Cloud

A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer 7.0 all versions, FortiAna…

9.3Kritisch
CVE-2026-126262
Fortinet FortiAnalyzer; Fortinet FortiManager

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, Fort…

7.7Hoch
CVE-2026-121528
Fortinet FortiOS

A improper certificate validation vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.13, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote and unauthenticated attacker to perform a…

9.0Kritisch
CVE-2026-126259
Fortinet FortiOS

A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker with HA FGSP + standalone-config-sync, or aut…

6.3Mittel
CVE-2026-121527
Fortinet FortiClientEMS

A execution with unnecessary privileges vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.7, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versions may allow an authenticated local attacker with admin privileges to gain root shell access…

7.4Hoch
CVE-2026-126255
Fortinet FortiOS; Fortinet FortiPAM

A path traversal: '../filedir' vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, For…