---
title: "FortiOS CVE-2019-6693: Hard-Coded Backup Key Now in KEV"
url: https://erroneo.us/security/briefs/fortios-hard-coded-config-backup-key-cve-2019-6693-kev/
description: "A hard-coded FortiOS key lets anyone with a config file decrypt VPN passwords and other secrets. Linked to Akira. Enable private-data-encryption and rotate."
type: security-brief
section: "Security Digest"
date_published: 2019-11-19
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2019-6693"]
severity: "medium"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# FortiOS CVE-2019-6693: Hard-Coded Backup Key Now in KEV

**Verdict: Check exposure.** Upgrading alone does not fix this: unless private-data-encryption is enabled, every FortiGate config file still protects its secrets with a key attackers know, so check the setting and rotate anything in leaked configs.

- **Who must act:** FortiGate owners who have never enabled private-data-encryption, and anyone whose unencrypted config backups have left the device, through file shares, tickets, forums, repositories or an earlier FortiOS compromise.
- **Who can relax:** FIPS-CC mode FortiGates, which Fortinet says are not affected, and devices with private-data-encryption enabled whose older backups were password-protected or whose secrets have since been rotated.
- **Affected:** FortiOS 6.2.0; FortiOS 6.0.0 through 6.0.6; FortiOS 5.6.10 and below; Later FortiOS versions while private-data-encryption remains disabled (the default)
- **Fixed:** FortiOS 5.6.11, 6.0.7, 6.2.1 and later, with private-data-encryption enabled; FortiOS 7.6.1 and later generate a random private-data-encryption key when the setting is enabled
- **CVEs:** CVE-2019-6693
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check each FortiGate with get system global | grep private-data-encryption.
2. Enable it (config system global / set private-data-encryption enable / end), following Fortinet's HA and FortiManager caveats.
3. Always password-protect configuration backups, and take fresh backups after enabling the setting.
4. Find old config files on shares, tickets and repositories and treat their ENC secrets as exposed.
5. Rotate local VPN user passwords, LDAP and RADIUS secrets, IPsec pre-shared keys, certificate passphrases and the HA password found in any exposed config.

### How to check if you are affected

- Search file shares and repositories for FortiGate configs with grep -rlE "set (passwd|password|psksecret) ENC".
- Review FortiGate VPN event logs for successful SSL VPN or IPsec logins by valid users from unfamiliar addresses or hosting providers.
- Check whether the device was ever hit by a config-leaking FortiOS bug or appeared in the January 2025 Belsen Group leak, and rotate its secrets if so.

## What happened

In November 2019, Fortinet published [FG-IR-19-007](https://fortiguard.com/psirt/FG-IR-19-007): FortiOS encrypted the "ENC" secrets in its CLI configuration and backup files with a single hard-coded key. Anyone who holds a config file and knows that key can decrypt the secrets. Per the [CVE record](https://www.cve.org/CVERecord?id=CVE-2019-6693), that covers users' passwords (but not administrator passwords), private key passphrases and the HA password. Fortinet's advisory says it applies to all ENC credential data except admin passwords, and calls exposed ENC data "easy to decrypt." [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-6693) scores it 6.5. The same advisory covers CVE-2020-9289, the equivalent issue in FortiManager and FortiAnalyzer.

Fortinet's fix was not a new key. FortiOS 5.6.11, 6.0.7 and 6.2.1 added an opt-in `private-data-encryption` setting that encrypts secrets with an administrator-supplied key instead. The setting is disabled by default.

The bug sat outside the KEV catalog for more than five years. CISA [added it on June 25, 2025](https://content.govdelivery.com/accounts/USDHSCISA/bulletins/3e6b3df), citing "evidence of active exploitation" without details, and marked it as used in ransomware. [The Hacker News](https://thehackernews.com/2025/06/cisa-adds-3-flaws-to-kev-catalog.html) connected the listing to vendor reporting on Akira. [Qualys](https://blog.qualys.com/vulnerabilities-threat-research/2024/10/02/threat-brief-understanding-akira-ransomware) and [AhnLab ASEC](https://asec.ahnlab.com/en/86310/) (February 2025) list CVE-2019-6693 among the flaws Akira uses for initial access, alongside FortiOS CVE-2022-40684. CISA has not described a specific incident.

## Who is affected

The listed versions are FortiOS 6.2.0, 6.0.0 to 6.0.6 and 5.6.10 and below. In practice, any FortiGate where `private-data-encryption` has never been enabled still writes secrets under the known key, whatever its version. FIPS-CC devices are not affected. The flaw only matters once an attacker has a configuration file. Unprotected backups on file shares, configs pasted into tickets or forums, and configs pulled through other FortiOS bugs all qualify. In January 2025 the Belsen Group dumped FortiGate configs and passwords allegedly from 15,000 organizations, mostly dating from 2022, [Rapid7](https://www.rapid7.com/blog/post/2025/01/16/etr-fortinet-firewalls-hit-with-new-zero-day-attack-older-data-leak/) reported.

## Do you really need to act?

Patching alone does not settle this one, so check two things. First, is `private-data-encryption` on? If not, every future backup is readable by anyone who gets it. Second, has an unencrypted config ever left the device? If so, assume the VPN user passwords, LDAP and RADIUS secrets and pre-shared keys inside it are known. A decrypted VPN password is a quiet way in, which suits ransomware crews.

## What to do now

1. Check the setting: `get system global | grep private-data-encryption`.
2. Enable it with `config system global`, `set private-data-encryption enable`, `end`. On FortiOS 7.6.1 and later the device [generates a random key](https://docs.fortinet.com/document/fortigate/8.0.0/fortios-release-notes/191180); older releases ask for 32 hex digits. Read Fortinet's HA and FortiManager notes first, and note that re-enabling it later [breaks restores](https://docs.fortinet.com/document/fortigate/7.6.3/fortios-release-notes/335540) of older backups.
3. Password-protect every backup, as the advisory's workaround says, and take a fresh one.
4. Rotate the secrets in any config that has left the device, and require MFA on VPN logins.

## How to tell if you were hit

Decryption happens offline, so the device logs nothing when it occurs. Find the exposure instead. Search shares, ticket attachments and repositories with `grep -rlE "set (passwd|password|psksecret) ENC" .` to locate FortiGate configs. Then review VPN event logs for successful SSL VPN or IPsec logins by valid users from unfamiliar addresses, especially hosting providers, since a stolen password produces a clean login.

## Timeline

- Nov 19, 2019 — Fortinet publishes FG-IR-19-007.
- Nov 21, 2019 — CVE-2019-6693 is published.
- Jan 15, 2025 — The Belsen Group leaks FortiGate configs allegedly from 15,000 organizations.
- Feb 10, 2025 — AhnLab ASEC lists the CVE among Akira's initial-access flaws.
- Jun 25, 2025 — CISA adds CVE-2019-6693 to KEV.
- Jul 16, 2025 — CISA's remediation deadline for federal agencies.

## Sources

1. [Fortinet PSIRT — FG-IR-19-007: Hardcoded symmetric key in fips.c](https://fortiguard.com/psirt/FG-IR-19-007)
2. [Fortinet — FortiOS 8.0.0 release notes: FortiManager support for updated FortiOS private data encryption key](https://docs.fortinet.com/document/fortigate/8.0.0/fortios-release-notes/191180)
3. [Fortinet — FortiOS 7.6.3 release notes: FortiGate cannot restore configuration file after private-data-encryption is re-enabled](https://docs.fortinet.com/document/fortigate/7.6.3/fortios-release-notes/335540)
4. [CVE record — CVE-2019-6693](https://www.cve.org/CVERecord?id=CVE-2019-6693)
5. [NVD — CVE-2019-6693](https://nvd.nist.gov/vuln/detail/CVE-2019-6693)
6. [CISA — Known Exploited Vulnerabilities: CVE-2019-6693](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6693)
7. [CISA — CISA Adds Three Known Exploited Vulnerabilities to Catalog (June 25, 2025)](https://content.govdelivery.com/accounts/USDHSCISA/bulletins/3e6b3df)
8. [Qualys — Threat Brief: Understanding Akira Ransomware](https://blog.qualys.com/vulnerabilities-threat-research/2024/10/02/threat-brief-understanding-akira-ransomware)
9. [AhnLab ASEC — Detecting Akira Ransomware Attack Using AhnLab EDR](https://asec.ahnlab.com/en/86310/)
10. [Rapid7 — Fortinet Firewalls Hit with New Zero-Day Attack, Older Data Leak](https://www.rapid7.com/blog/post/2025/01/16/etr-fortinet-firewalls-hit-with-new-zero-day-attack-older-data-leak/)
11. [The Hacker News — CISA Adds 3 Flaws to KEV Catalog](https://thehackernews.com/2025/06/cisa-adds-3-flaws-to-kev-catalog.html)

---
Source page: https://erroneo.us/security/briefs/fortios-hard-coded-config-backup-key-cve-2019-6693-kev/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt