DaystoPatch

FortinetExploited incident

FortiOS hard-coded key used to encrypt secrets in configuration backups

CVE-2019-6693Medium, CVSS 4.3In CISA's Known Exploited Vulnerabilities catalog since 25 Jun 2025

  • Exploited after a fix existed
  • Known ransomware use
FixedFixed for every supported version on the day it became public.

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Fortinet PSIRT FG-IR-19-007 (revision history)CuratedQuote verified

    11-19-2019 Initial Version

    Reported under responsible disclosure; the advisory is the first public signal. Exploitation (credential decryption from exposed configuration files, used by ransomware actors) was reported years later; KEV 2025-06-25.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:1e234dbc24f624f4…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    CVE.org record CVE-2019-6693ClaimedQuote verified21 Nov 2019, 15:08 UTC

    Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:fd8bc053c8c12c9e…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2019-6693)ClaimedQuote verified25 Jun 2025

    Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability

    Added to CISA's KEV catalog on 2025-06-25.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet25 Jun 2025, 17:45 UTC

    CVE-2019-6693

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet17 Mar 2026, 15:03 UTC

    Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Shifting Threat Landscape # CVE_2024_21762 # CVE_2021_27877 # CVE_2021_27878 # CVE_2021_40539 # CVE_2024_55591 # CVE_2019_6693 #

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Hacker NewsClaimedQuote not checked yet23 Apr 2026, 11:43 UTC

    Iran claims US exploited networking equipment backdoors during strikes

    Earliest third-party post we hold.

    Source
    Hacker News hn
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    Fortinet PSIRT FG-IR-19-007 (revision history)CuratedQuote verified

    11-19-2019 Initial Version

    Conflict: the page metadata says 'Published Date Jun 30, 2020' and its Timeline says '2020-06-30: Initial publication', which matches the revision that added FortiAnalyzer; the in-text revision history gives 11-19-2019 as the initial version. The earlier date is used.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:1e234dbc24f624f4…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Fortinet PSIRT FG-IR-19-007 (Wayback snapshot 2019-12-06 17:58 UTC)CuratedQuote verified

    In versions 5.6.11, 6.0.7 and 6.2.1 and above, admins can choose to be prompted for a password, which is then used by FortiOS to encrypt sensitive data in the configuration file.

    The 2019 version of the advisory (capture 2019-12-06, 'Date Nov 19, 2019') lists the opt-in private-data-encryption option in 5.6.11/6.0.7/6.2.1 as the solution; the setting is disabled by default, so it works more like a mitigation than a fix. Upper bound: fixed builds may have shipped earlier (5.6.11, 6.0.7 and 6.2.1 predate the advisory; their release dates were not verified).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:dac4ff345ec47055…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Fortinet PSIRT FG-IR-19-007 (Wayback snapshot 2019-12-06 17:58 UTC)CuratedQuote verified

    In versions 5.6.11, 6.0.7 and 6.2.1 and above, admins can choose to be prompted for a password, which is then used by FortiOS to encrypt sensitive data in the configuration file.

    All three FortiOS branches then supported (5.6, 6.0, 6.2) had the option in the 2019 version of the advisory.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:dac4ff345ec47055…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • FortiOS
How we built this timeline

Old bug included because CISA added it to KEV on 25 Jun 2025 (ransomware use Known). The same advisory was extended in June 2020 with CVE-2020-9289 for FortiManager (fixed 6.2.5) and FortiAnalyzer (fixed 6.2.4); that CVE is not in KEV and was added seven months later for different products, so it is not included here (reviewer may disagree under the same-advisory grouping rule).

CVSS: Fortinet's own CVSSv3 score on FG-IR-19-007 is 4.3 (NVD gives 6.5); the vendor score is used (corrected 23 Oct 2026). The protection requires enabling 'private-data-encryption', so devices on fixed versions remain exposed unless configured.

The 2019 capture has no workaround section; the backup-password workaround on the live page was added in a later revision (revision history: '11-13-2020 Update Solution section'), so the Workaround moment was removed rather than dated to 2019. Automated check: the vendor's original advisory is outside our collected window (the vendor's own CVE record was published 21 Nov 2019, 221 days before the earliest vendor item we hold); automated vendor and patch moments are left unknown.

Related

Fortinet report card