CVE-2019-6223

published 2019-03-05

CVE-2019-6223: A logic issue existed in the handling of Group FaceTime calls. The issue was addressed with improved state management. This issue is fixed in iOS 12.1.4, macOS…

Priority P2 77 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

KEV ITW

A logic issue existed in the handling of Group FaceTime calls. The issue was addressed with improved state management. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. The initiator of a Group FaceTime call may be able to cause the recipient to answer.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
apple	ios	—	—
apple	ios	>= unspecified < iOS 12.1.3	iOS 12.1.3
apple	iphone_os	< 12.1.4	12.1.4
apple	mac_os_x	< 10.14.3	10.14.3
apple	macos	>= unspecified < macOS Mojave 10.14.3	macOS Mojave 10.14.3
apple	macos_mojave_10.14.3_supplemental_update	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → Monitor for Group FaceTime calls being answered without user interaction or consent, which may indicate exploitation of the logic flaw in call state management. ↗
• → Focus detection on FaceTime component behavior on unpatched iOS versions prior to 12.1.4 and macOS Mojave versions prior to 10.14.3 Supplemental Update. ↗
• → Flag devices where FaceTime audio/video sessions are established without explicit user acceptance — indicative of the improper state management being exploited. ↗

• · No specific exploit code, network indicators, hashes, or signatures are publicly documented for this vulnerability. Detection is limited to behavioral and version-based indicators. ↗
• · The vulnerability is a logic/state management flaw in the FaceTime component, not a memory corruption or code injection issue, making network-level detection signatures difficult to craft. ↗

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

vulncheck 7.5 HIGH

cisa 7.5 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.