CVE‑2019‑6693: Fortinet FortiOS Hard‑Coded Credentials Vulnerability Allows Decryption of Configuration Backups
What It Is — Fortinet FortiOS embeds a hard‑coded cryptographic key that encrypts configuration‑backup files. Possession of this key lets an attacker decrypt the backup and read sensitive configuration data, including admin credentials and network secrets.
Exploitability — No public exploit has been released, but the flaw is trivial to leverage once the key is known. The CVSS score reported by NVD is 7.5 (High).
Affected Products — FortiOS versions prior to the vendor‑issued patch (all 5.6.x, 6.0.x, and 6.2.x releases before the remediation update).
Why It Matters for Trust & Control Assurance
- Hard‑coded credentials defeat credential‑management controls, exposing a gap in the “identity and access management” control objective.
- Decrypted backups can reveal privileged accounts and network topology, eroding the audit trail that demonstrates secure configuration management.
- Enterprise buyers now expect continuous evidence that credential hygiene is enforced and that remediation is documented in a defensible control‑assurance repository.
Recommended Actions
- Deploy Fortinet’s security patch immediately.
- Rotate all administrative passwords and re‑encrypt existing backups with unique, organization‑controlled keys.
- Institute a formal credential‑management program that includes periodic key rotation, automated detection of hard‑coded secrets, and evidence collection for audit.
- Update your control‑mapping inventory to reflect remediation of the credential‑management objective.
Source: CISA KEV – CVE‑2019‑6693