Loading vulnerability…
CVE-2019-6693 is an information disclosure vulnerability in FortiOS, FortiManager, and FortiAnalyzer caused by the use of a hard-coded cryptographic key to protect sensitive data stored in configuration backups and CLI configuration data. Because the encryption key is fixed and recoverable, an attacker who obtains a vulnerable backup file or relevant CLI configuration content can decrypt protected secrets without needing to break the cryptography itself. Exposed data can include non-administrator user passwords, private key passphrases, and High Availability passwords when configured. The issue is fundamentally a key-management failure in which sensitive configuration material is encrypted with a product-wide embedded key rather than a unique secret under customer control.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository provides a proof-of-concept Python script (fortigate_decrypt.py) that exploits CVE-2019-6693, a vulnerability in Fortinet FortiGate appliances prior to version 6.2.0 (and specific 6.0.x and 5.6.x versions). The script decrypts configuration secrets that are stored using a static AES key. The user supplies a base64-encoded encrypted secret (as found in FortiGate configuration files) as a command-line argument. The script decodes the input, constructs the IV from the first 4 bytes of the ciphertext, and decrypts the remainder using the static key. The decrypted secret is then printed. The repository consists of a README.md explaining the vulnerability and usage, and the Python script itself. No network or remote attack is performed; the exploit is local and requires access to the configuration file.
This repository provides a Python script (fortigate-decrypt.py) that exploits CVE-2019-6693, a vulnerability in Fortinet FortiOS (FortiGate) devices. The vulnerability allows an attacker with access to configuration files and knowledge of the static encryption key to decrypt user and High Availability (HA) passwords stored in those files. The script requires two input files: 'data.txt' (containing user data from 'show user local') and 'ha_config.txt' (containing HA configuration from 'show system ha'). It uses a hardcoded AES key ('Mary had a littl') to decrypt base64-encoded password fields and prints the decrypted plaintext passwords. The repository includes a README with usage instructions and a .gitignore. The exploit is operational, as it provides working decryption functionality, but it is not weaponized for remote exploitation; it requires prior access to the configuration files.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Fortinet vulnerability that allows attackers to obtain and decrypt password data from vulnerable Fortinet device configurations; it was used as part of a chained exploitation workflow against Fortinet appliances.
A Fortinet vulnerability that CISA KEV’s knownRansomwareCampaignUse field silently flipped to Known during 2025 (evidence of ransomware campaign use).
A use of hard-coded credentials vulnerability in Fortinet FortiOS, actively exploited in ransomware attacks.
A hard-coded cryptographic key vulnerability in FortiOS, FortiManager, and FortiAnalyzer, allowing attackers to decrypt sensitive password data from CLI configuration or backup files.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.