CVE-2019-6223KEV · OVERDUE

Apple iOS and macOS Group Facetime Vulnerability

High · published March 5, 2019

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.5. It is confirmed in active exploitation. It sits in the 85.4th percentile for exploit probability.

1634
days past CISA
deadline
CVSS v3.1
7.5
EPSS
3%
Percentile
85.4
In the wild
Confirmed
What it is

🚨 A logic flaw in Group FaceTime could let someone force you to answer a call, even when you’re busy! 📞 Think of it like someone at a party who can shout your name loud enough to get you to answer, no matter how uninterested you are in talking to them. This flaw undermines your ability to manage your own conversations, just like that party crasher who refuses to take a hint! Imagine a scenario where someone could call you repeatedly without your consent, leaving you vulnerable to unwanted attention and interruptions. This could lead to serious privacy breaches, as the recipient may inadvertently expose themselves in sensitive situations. With this flaw actively exploited, the consequences could feel absolutely overwhelming!

Put simply

Think of it like someone at a party who can shout your name loud enough to get you to answer, no matter how uninterested you are in talking to them. This flaw undermines your ability to manage your own conversations, just like that party crasher who refuses to take a hint! The vulnerability lies in the state management of Group FaceTime calls, allowing the call initiator to manipulate the connection and force the recipient to answer without their consent. This flaw can be troublesome, especially when it allows unintended access to conversations.

What to do

Imagine a scenario where someone could call you repeatedly without your consent, leaving you vulnerable to unwanted attention and interruptions. This could lead to serious privacy breaches, as the recipient may inadvertently expose themselves in sensitive situations. With this flaw actively exploited, the consequences could feel absolutely overwhelming! To protect yourself, immediately update your devices to iOS 12.1.4 or macOS Mojave 10.14.3 Supplemental Update. These updates contain crucial fixes that close this loophole. Don’t forget to check settings and ensure you're regularly updating to stay ahead of similar threats! You've got this! Follow these steps and secure your conversations today! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.02629 · 85.4th percentile
Published
2019-03-05T16:00Z
KEV added
2021-11-03 · due 2022-05-03
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by May 3
    kev
  • 05 MAR 16:00Z
    A logic issue existed in the handling of Group FaceTime calls
    cvelistv5