CVE-2019-6698 Hardcoded credentials in Fortinet FortiRecorder
An unauthenticated attacker with network access can use hard-coded credentials to take control of FortiCameras managed by FortiRecorder.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-6698?
CVE-2019-6698 is a critical vulnerability in Fortinet FortiRecorder, published on 23 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Use of Hard-coded Credentials vulnerability in FortiRecorder all versions below 2.7.4 may allow an unauthenticated attacker with knowledge of the aforementioned credentials and network access to FortiCameras to take control of those, provided they are managed by a FortiRecorder device.
Weakness: CWE-798
Which versions are affected by CVE-2019-6698?
It affects 1 product.
Products include Fortinet Fortirecorder Firmware.
How do I fix CVE-2019-6698?
No fix has been published for CVE-2019-6698 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-6698 being exploited?
There is no known exploitation of CVE-2019-6698 in the wild and no public exploit code.
Other vulnerabilities in Fortinet FortiRecorder
Sources
Also known as GHSA-7f85-jgjr-85qj.