CVE-2019-6223
Apple iOS and macOS Group Facetime Vulnerability
Description
CVE-2019-6223 is a HIGH severity logic vulnerability in Apple iOS and macOS Group FaceTime. The flaw exists in the handling of Group FaceTime calls, where the call initiator can cause the recipient's device to answer a call without user interaction. With a CVSS 3.1 score of 7.5, this vulnerability allows an attacker to eavesdrop on audio (and briefly video) from a recipient before they accept or decline the call. The vulnerability affects iOS versions prior to 12.1.4 and macOS Mojave prior to the 10.14.3 Supplemental Update. CISA added CVE-2019-6223 to its KEV catalog on November 3, 2021. The EPSS score of 0.00159 (36.79th percentile) is relatively low, reflecting that exploitation requires specific call-initiation conditions rather than a traditional remote exploit.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apple | iphone os | < 12.1.4 |
| apple | mac os x | < 10.14.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://support.apple.com/HT209520(Release Notes, Vendor Advisory)
- https://support.apple.com/HT209521(Release Notes, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6223(US Government Resource)
Weakness Type
CWE-Unknown: Logic Error in State Management
CVE-2019-6223 is a logic vulnerability in Apple's Group FaceTime call handling. Unlike typical memory corruption or injection flaws, this vulnerability stems from a state management error in the FaceTime protocol. The system failed to properly enforce the requirement that a recipient must actively accept a call before audio and video transmission begins. When a Group FaceTime call was initiated and the caller added their own number to the group before the recipient answered, the system erroneously transitioned the call into an active state on the recipient's device. This caused the recipient's microphone — and briefly their camera — to begin transmitting without the user's knowledge or consent.
The flaw highlights the danger of complex state machines in communication protocols, where edge cases in call setup logic can bypass fundamental privacy assumptions. Apple addressed the issue with improved state management validation in the FaceTime protocol.
Learn more: CWE-840 — Business Logic Errors
Impact Analysis
CVE-2019-6223 carries a CVSS 3.1 base score of 7.5 (HIGH) with network-accessible attack characteristics.
Confidentiality (High): The primary impact is unauthorized audio surveillance. An attacker can listen to a victim's environment through their device microphone without any indication to the victim. In some scenarios, brief video access was also possible. This represents a severe privacy violation, as the victim has no knowledge they are being monitored. Sensitive conversations, business discussions, and private communications could all be intercepted.
Integrity (None): The vulnerability does not allow modification of data or system files. The attacker cannot alter device settings, install software, or modify any content on the victim's device.
Availability (None): The vulnerability does not cause denial of service or system disruption. The victim's device continues to function normally during exploitation, which actually makes the attack more dangerous since it operates without visible symptoms.
Scope (Unchanged): The vulnerability is confined to the FaceTime application's call handling. However, the real-world impact extends beyond technical scope — the ability to silently eavesdrop on anyone with an Apple device running vulnerable iOS or macOS versions represents a significant threat to personal privacy and organizational security.
Exploit Maturity
Active Exploitation: CVE-2019-6223 received widespread public attention when it was discovered by a 14-year-old in January 2019, who reported it to Apple before it became widely known. CISA added this vulnerability to the Known Exploited Vulnerabilities catalog on November 3, 2021, confirming active exploitation in the wild.
Exploit Simplicity: The exploit required no technical tools or specialized knowledge — it could be triggered by any FaceTime user through the standard Group FaceTime interface. The attacker simply needed to initiate a Group FaceTime call and add their own number to the group conversation before the recipient answered. This extremely low barrier to exploitation made it accessible to any Apple device user.
Public Disclosure: The vulnerability received massive media coverage in late January 2019, leading Apple to temporarily disable the Group FaceTime feature server-side while developing a fix. The public nature of the exploit meant that any user who followed the simple steps could exploit it against any other iOS or macOS user.
Ransomware Association: CISA's KEV catalog does not indicate a known ransomware association for this vulnerability.
EPSS Context: The EPSS score of 0.00159 (36.79th percentile) is relatively low because the vulnerability does not enable traditional remote code execution, but rather unauthorized audio/video access through a legitimate application feature.
Remediation
-
Update to iOS 12.1.4 or later immediately. Apple released iOS 12.1.4 on February 7, 2019, which addresses the Group FaceTime logic flaw. Install this update through Settings > General > Software Update on all iOS devices.
-
Apply the macOS Mojave 10.14.3 Supplemental Update. For Mac systems, install the supplemental update available through the Mac App Store or System Preferences > Software Update. This corrects the FaceTime state management issue on macOS.
-
Verify FaceTime is updated on all organizational devices. In enterprise environments, use mobile device management (MDM) solutions to verify that all managed Apple devices have been updated to the patched versions. Create compliance policies that flag devices running vulnerable iOS or macOS versions.
-
Disable FaceTime on unpatched devices as an interim measure. If immediate patching is not possible, disable FaceTime through Settings > FaceTime on iOS or through MDM restrictions. This eliminates the attack vector until the device can be updated.
-
Review organizational communication security policies. Use this vulnerability as an opportunity to audit communication platform security. Ensure that sensitive meetings use verified, updated software and that employees understand the risks of unpatched communication applications.
-
Monitor Apple security advisories. Subscribe to Apple product security announcements at https://support.apple.com/en-us/HT201222 to receive timely notification of future vulnerabilities affecting organizational Apple devices.
Technical Details
CVE-2019-6223 is a logic vulnerability in Apple's Group FaceTime implementation affecting the call setup state machine. The vulnerability was introduced with the Group FaceTime feature in iOS 12.1 and the corresponding macOS Mojave updates.
The technical root cause lies in the FaceTime protocol's state management during group call establishment. When a user initiates a Group FaceTime call, the protocol transitions through several states: call initiation, ringing, connection negotiation, and active call. The vulnerability exists because adding a participant (including the caller's own number) to the group during the ringing phase triggers an incorrect state transition on the recipient's device.
Specifically, when the caller adds themselves to the call while it is still ringing on the recipient's device, the FaceTime protocol interprets this as a multi-party call connection event. The recipient's device erroneously transitions from the ringing state to the connected state, activating the microphone and beginning audio transmission back to the caller. If the recipient interacted with the incoming call notification (for example, pressing the power button to dismiss it), the front-facing camera would also briefly activate.
The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects that the attack is network-based, requires no special privileges or user interaction from the victim, and results in high confidentiality impact without affecting integrity or availability. The attack can be executed entirely from the caller's device using the standard FaceTime interface.
Apple's fix addressed the state management logic to ensure that audio and video transmission cannot begin until the recipient explicitly accepts the call. Apple also temporarily disabled Group FaceTime at the server level before the client-side patch was available.
Frequently Asked Questions
Is CVE-2019-6223 being actively exploited?
Yes. CISA added CVE-2019-6223 to its Known Exploited Vulnerabilities catalog on November 3, 2021. The vulnerability gained widespread attention in January 2019 when the simple exploitation method was publicly disclosed. Because the exploit required no technical skill — only initiating a Group FaceTime call and adding one's own number — it was accessible to any Apple device user.
What products are affected by CVE-2019-6223?
CVE-2019-6223 affects Apple iPhone OS (iOS) versions before 12.1.4 and Apple macOS (Mac OS X) versions before the Mojave 10.14.3 Supplemental Update. Any iPhone, iPad, iPod touch, or Mac with Group FaceTime enabled and running these vulnerable versions was at risk.
How do I fix CVE-2019-6223?
Update iOS devices to version 12.1.4 or later and macOS to the Mojave 10.14.3 Supplemental Update or later. If devices cannot be immediately updated, disable FaceTime as an interim mitigation. Apple also disabled Group FaceTime at the server level during the vulnerability window, but the permanent fix requires client-side updates.
How severe is CVE-2019-6223?
CVE-2019-6223 is rated HIGH with a CVSS score of 7.5. While it does not enable remote code execution, its severity stems from the ability to silently eavesdrop on any Apple device user through audio surveillance and brief video capture. The trivial exploitation method and the massive installed base of Apple devices made this an exceptionally impactful privacy vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.