Exploitation active confirmée

Ajoutée au catalogue CISA KEV le 25/06/2025, correctif exigé avant le 16/07/2025 pour les agences fédérales américaines.

Action requise : Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description officielle (NVD)

Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key.

Preuves de concept publiques (4)

Dépôts tiers non vérifiés, parfois piégés. Ne les exécutez jamais en production : uniquement dans un environnement de test isolé.

saladandonionrings/cve-2019-6693 · ★ 30 · 08/12/2023
An authorized remote user with access or knowledge of the standard encryption key can gain access and decrypt the FortiOS backup files and all non-administator passwords, private keys and High Availab
synacktiv/CVE-2020-9289 · ★ 11 · 30/06/2023
Decrypt reversible secrets encrypted using the default hardcoded key related to CVE-2020-9289 on FortiAnalyzer/FortiManager (the only difference with CVE-2019-6693 is the encryption routine).
gquere/CVE-2019-6693 · ★ 8 · 21/12/2021
Decrypt FortiGate configuration secrets
Real4XoR/CVE-2019-6693 · ★ 1 · 26/08/2025