CVE-2019-6693

What Is FortiOS Configuration Backup?

FortiGate firewalls, running FortiOS, support exporting the device's full configuration as a backup file — used for disaster recovery, migration, and change management. Because these backups can contain sensitive values (passwords, PSKs, private keys) that administrators might otherwise assume are protected by encryption, the strength of that encryption directly determines whether a leaked or intercepted backup file exposes the firewall's secrets.

Overview

CVE-2019-6693 is a use of hard-coded cryptographic key vulnerability (CWE-798) in FortiOS. Sensitive data within FortiOS configuration backup files is encrypted using a key that is hard-coded and identical across FortiGate deployments, rather than being unique per device or per administrator. An attacker who obtains a configuration backup file and knows (or derives) this hard-coded key can decrypt the protected values inside it. CVSS score: 6.5, requiring low privileges and local access to trigger the underlying condition.

Technical Details

FortiOS configuration backups store sensitive fields — such as local user passwords, VPN pre-shared keys, and certificate private keys — in an encrypted form intended to protect them if the backup file is copied, transferred, or otherwise handled outside the device. Because the encryption key is hard-coded into FortiOS itself rather than being device-specific or admin-supplied, anyone who has extracted or reverse-engineered the key (which, being shared across all devices running the affected FortiOS versions, only needs to be discovered once) can decrypt the sensitive fields in any FortiGate configuration backup they obtain. This converts what administrators may treat as a "safe to store/transfer" encrypted artifact into effectively plaintext-equivalent sensitive data once the key is known.

Discovery

Fortinet disclosed and addressed this vulnerability through its PSIRT advisory FG-IR-19-007.

Exploitation Context

CISA added this vulnerability to the KEV catalog in mid-2025 with a ransomware association, indicating it has been used as part of real-world ransomware intrusions — plausibly by attackers who obtained configuration backup files (through prior network access, exposed backup storage, or supply-chain/MSP compromise) and used the hard-coded key to recover credentials and VPN secrets, enabling further lateral movement or persistent access into victim networks.

Remediation

1. Apply the FortiOS update referenced in FG-IR-19-007 that addresses this hard-coded key issue.
2. Treat all existing configuration backup files as potentially exposed — rotate any credentials, PSKs, and certificates that were present in backups created before patching.
3. Restrict access to configuration backup files with strict access controls and encryption independent of FortiOS's own built-in protection.
4. Avoid storing configuration backups in easily accessible or shared locations, including unsecured file shares, email, or third-party backup services without additional protection.
5. Audit backup and disaster-recovery processes for FortiGate devices to ensure sensitive configuration data isn't inadvertently exposed to unauthorized parties, including MSPs or contractors with backup access.