FortiOS CVE-2019-6693: Hard-Coded Backup Key Now in KEV
Upgrading alone does not fix this: unless private-data-encryption is enabled, every FortiGate config file still protects its secrets with a key attackers know, so check the setting and rotate anything in leaked configs.
Must act: FortiGate owners who have never enabled private-data-encryption, and anyone whose unencrypted config backups have left the device, through file shares, tickets, forums, repositories or an earlier FortiOS compromise.
Can relax: FIPS-CC mode FortiGates, which Fortinet says are not affected, and devices with private-data-encryption enabled whose older backups were password-protected or whose secrets have since been rotated.
- Check each FortiGate with get system global | grep private-data-encryption.
- Enable it (config system global / set private-data-encryption enable / end), following Fortinet's HA and FortiManager caveats.
- Always password-protect configuration backups, and take fresh backups after enabling the setting.