CVE-2019-6693

Fortinet FortiOS shipped with hard-coded credentials allowing attackers to decrypt sensitive data from configuration backups.

Fortinet FortiOS contained hard-coded credentials that enabled attackers to decrypt sensitive data from configuration backup files. This is a severe compliance failure for DIB organizations because it violates the principle of least privilege and exposes sensitive data to decryption without proper authentication. Organizations must audit their Fortinet deployments for known hard-coded credentials and apply patches immediately to prevent data exposure and compliance violations.

Shame score — Hard-coded credentials in a core security product are a fundamental design flaw that is entirely avoidable and directly enables data decryption, representing a severe negligence failure.