CVE-2019-17659

—

CVSS 3.1

8.1 high

EPSS

<1%p49

Published

Mar 17, 2025 (Mar 17, 2025)

Modified

Jun 17, 2026

Description

A use of hard-coded cryptographic key vulnerability in FortiSIEM version 5.2.6 may allow a remote unauthenticated attacker to obtain SSH access to the supervisor as the restricted user "tunneluser" by leveraging knowledge of the private key from another installation or a firmware image.

Vendors: fortinet
Products: fortisiem
Weakness: CWE-798
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news2 stories

Fortinet removed hardcoded SSH keys and DB backdoors from FortiSIEM

Security AffairsJan 28, 07:46 UTC · Jan 28, 2020Malware CVE-2019-17659 CVE-2019-16153

Expert found a hardcoded SSH Key in Fortinet SIEM appliances

Security AffairsJan 21, 06:14 UTC · Jan 21, 2020Vulnerability CVE-2019-17659