CVE-2019-6693

CVE-2019-6693 is a critical vulnerability affecting Fortinet FortiOS, where a hard-coded cryptographic key is used to encrypt sensitive data within configuration backup files. An attacker with access to these backup files can decrypt sensitive information, including user passwords (excluding the administrator's), private key passphrases, and High Availability passwords. This medium-severity vulnerability (CVSS 6.5) has a low attack complexity and high confidentiality impact, as it allows for unauthorized disclosure of critical system credentials. Notably, this CVE is actively exploited in the wild, including in known ransomware campaigns, despite no public exploit code being available in common repositories like Metasploit or Nuclei.