{"id":"CVE-2019-6223","published":"2019-03-05T16:29:02Z","modified":"2026-06-17T02:38:50Z","title":"Apple iOS and macOS Group Facetime Vulnerability","vendor":"Apple","product":"iOS and macOS","tier":"core","eol":null,"description":{"text":"A logic issue existed in the handling of Group FaceTime calls. The issue was addressed with improved state management. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. The initiator of a Group FaceTime call may be able to cause the recipient to answer.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a logic issue in the handling of Group FaceTime calls in Apple's iOS and macOS, specifically in how call state was managed. An attacker who initiates a Group FaceTime call can cause the recipient to answer it, and the attack needs only network access, with no authentication or user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:14:23Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.02629,"percentile":0.85509,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-6223","provenance":"source"},"vulncheckKev":{"dateAdded":"2019-02-08","exploitedFirstSeen":"2019-02-08","ransomware":false,"evidence":[{"url":"https://www.eweek.com/security/apple-patches-facetime-vulnerability-in-ios-macos-updates/","date":"2019-02-08"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":null,"cwes":[],"references":[{"url":"https://support.apple.com/HT209520","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/HT209521","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/HT209520","tags":["Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/HT209521","tags":["Release Notes","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6223","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote unauthenticated network attacker triggers call; public-facing service abuse","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"The initiator of a Group FaceTime call may be able to cause the recipient to answer","start":196,"end":279}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Only supports unauthorized call answering, not data access","mappingType":"primary_impact","evidence":[{"from":"description","quote":"The initiator of a Group FaceTime call may be able to cause the recipient to answer","start":196,"end":279}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-15790","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-15790","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"}],"timeline":[{"date":"2019-02-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.eweek.com/security/apple-patches-facetime-vulnerability-in-ios-macos-updates/","provenance":"source"},{"date":"2019-03-05","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6223","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-15790","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":974},"priority":{"score":57.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2823 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":17.1,"detail":"percentile 0.8551"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}