CVE-2024-23282 in watchOS
Summary
by MITRE • 06/11/2024
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, watchOS 10.5. A maliciously crafted email may be able to initiate FaceTime calls without user authorization.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/03/2026
This vulnerability represents a significant security flaw in Apple's FaceTime implementation that could enable unauthorized initiation of video calls through malicious email content. The issue stems from insufficient input validation and authorization checks within the FaceTime calling mechanism, allowing attackers to craft specially formatted emails that could trigger automatic call initiation without user interaction. The vulnerability specifically affects Apple's ecosystem across multiple operating systems including iOS, iPadOS, macOS Sonoma, and watchOS, indicating a widespread impact across the company's mobile and desktop platforms. The flaw operates at the application layer where email clients process FaceTime links, creating a vector through which attackers can exploit the trust relationship between email applications and FaceTime services. This represents a classic example of privilege escalation through social engineering, where the malicious email acts as a bridge to bypass normal user authorization requirements. The vulnerability is particularly concerning as it leverages the trusted email delivery mechanism to execute unauthorized actions, potentially exposing users to privacy violations, unwanted communication, and potential further exploitation through the FaceTime call initiation process.
The technical implementation of this vulnerability involves the improper handling of FaceTime invitation links within email clients, where the system fails to properly validate the source and legitimacy of incoming FaceTime requests. This flaw creates an authorization bypass condition where the system automatically processes and initiates FaceTime calls based on malformed or crafted email content without requiring explicit user confirmation. The issue manifests when email clients parse FaceTime URLs or invitation data and fail to implement proper verification mechanisms to ensure the request originates from a legitimate source. This vulnerability can be classified under CWE-345 Insufficient Verification of Data Authenticity, as the system does not adequately verify the authenticity of FaceTime invitation data. The problem is exacerbated by the fact that FaceTime calls can be initiated with minimal user interaction, making the attack surface particularly dangerous. The vulnerability also demonstrates characteristics of CWE-20 Improper Input Validation, where the system fails to properly validate the format and source of incoming FaceTime invitation data, allowing malicious input to be processed without proper sanitization or verification.
The operational impact of this vulnerability extends beyond simple unauthorized FaceTime calls, potentially exposing users to privacy breaches, unwanted communication, and further exploitation opportunities. Attackers could use this vulnerability to initiate FaceTime calls to unsuspecting users, potentially leading to social engineering attacks or privacy violations. The vulnerability could also enable attackers to establish communication channels with victims without their knowledge or consent, creating opportunities for further malicious activities. Additionally, the widespread nature of the affected platforms means that users across multiple Apple devices are potentially at risk, increasing the overall attack surface and impact. This vulnerability could also be leveraged as a stepping stone for more sophisticated attacks, where initial unauthorized FaceTime calls could be used to establish contact with victims for phishing or other malicious activities. The attack could be particularly effective in corporate environments where users might be more likely to accept FaceTime invitations from colleagues or business contacts, making the social engineering aspect even more dangerous.
Apple's response to this vulnerability involved implementing enhanced input validation and authorization checks within the FaceTime system, requiring additional verification steps before initiating any FaceTime calls from email content. The security patches released in iOS 16.7.8, iPadOS 16.7.8, iOS 17.5, iPadOS 17.5, macOS Sonoma 14.5, and watchOS 10.5 address the root cause by strengthening the validation of FaceTime invitation data and requiring explicit user confirmation before initiating calls. These mitigations align with ATT&CK framework techniques such as T1566.001 Phishing, where the attack vector involves malicious email content, and T1071.004 Application Layer Protocol, where the attack exploits application-level protocols. Organizations should prioritize updating all affected Apple devices to the latest security patches to eliminate this vulnerability. Security teams should also implement monitoring for unusual FaceTime call patterns and consider user education about the risks of opening suspicious emails, particularly those containing FaceTime links. The mitigation strategy should include regular security assessments to ensure that all endpoints are properly patched and that users understand the potential risks associated with email-based FaceTime invitations. This vulnerability highlights the importance of maintaining up-to-date security measures across all platforms and the critical need for proper input validation in all application components that handle user data or external input.