CVE-2019-5593

MEDIUM

FortiOS < 5.6.10, 6.0.0-6.0.6, 6.2.0-6.2.1 - Unauthenticated Private Key Exposure via CLI Console

Title source: llm

Description

Improper permission or value checking in the CLI console may allow a non-privileged user to obtain Fortinet FortiOS plaint text private keys of system's builtin local certificates via unsetting the keys encryption password in FortiOS 6.2.0, 6.0.0 to 6.0.6, 5.6.10 and below or for user uploaded local certificates via setting an empty password in FortiOS 6.2.1, 6.2.0, 6.0.6 and below.

References (1)

Core 1

Core References

Mitigation, Vendor Advisory x_refsource_misc

https://fortiguard.com/psirt/FG-IR-19-134

Scores

CVSS v3 5.5

EPSS 0.0003

EPSS Percentile 10.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-755

Status published

Products (2)

fortinet/fortios 6.2.0

fortinet/fortios < 5.6.10

Published Jan 23, 2020

Tracked Since Feb 18, 2026