Medium severity · published Jan 23, 2020
CVE-2019-5593
Improper permission or value checking in the CLI console may allow a non-privileged user to obtain Fortinet FortiOS plaint text private keys of system's builtin local certificates…
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
Improper permission or value checking in the CLI console may allow a non-privileged user to obtain Fortinet FortiOS plaint text private keys of system's builtin local certificates via unsetting the keys encryption password in FortiOS 6.2.0, 6.0.0 to 6.0.6, 5.6.10 and below or for user uploaded local certificates via setting an empty password in FortiOS 6.2.1, 6.2.0, 6.0.6 and below.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
FortiOS · Fortinet
through 5.6.10; 6.0.0 through 6.0.6; 6.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-5593
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-5593
Mitigation
https://fortiguard.com/psirt/FG-IR-19-134
More from FortiOS
9.8
CVE-2026-24858
Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
9.8
CVE-2025-25249
Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
9.8
CVE-2025-59718
Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
9.8
CVE-2024-55591
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
9.8
CVE-2024-23113
Fortinet Multiple Products Format String Vulnerability