Group FaceTime Vulnerability (CVE‑2019‑6223) Enables Unauthenticated Call Answer on iOS & macOS
What It Is – An unspecified flaw in Apple’s Group FaceTime implementation lets a malicious caller trigger the recipient’s device to answer a video call without any user interaction.
Exploitability – The vulnerability is remotely exploitable; proof‑of‑concept code has been publicly released. No CVSS score is published in the CISA KEV entry, but industry scoring places it in the High severity range (≈7.5 CVSS v3).
Affected Products – Apple iOS (all supported versions) and macOS devices that include Group FaceTime.
Why It Matters for Trust & Control Assurance
- Access‑control hygiene – The flaw bypasses the user‑level “accept call” control, highlighting the need for strict device‑level access policies and continuous verification that only authorized software can invoke UI actions.
- Patch‑management evidence – Demonstrating that all endpoints are running Apple’s latest security updates is a core control‑objective for many frameworks; a missing patch becomes a tangible audit finding.
- Logging & monitoring – Unexpected call‑answer events should be captured in endpoint logs; correlating them with threat‑intel feeds provides defensible evidence of a control breach or attempted exploitation.
Recommended Actions
- Deploy Apple’s security update that addresses CVE‑2019‑6223 across all managed iOS and macOS devices.
- Verify patch compliance through your endpoint‑management solution and retain evidence for audit purposes.
- Enable detailed call‑activity logging on devices and ingest logs into a SIEM for anomaly detection.
- Update your device‑access policies to require explicit user interaction for any inbound communication.
- Conduct a rapid tabletop exercise to test response procedures for unauthorized device‑level actions.
Source: CISA KEV – CVE‑2019‑6223