CVE-2021-1872 is a logic issue in Apple's iOS, iPadOS, and macOS that could prevent muting a CallKit call while ringing, due to improper state management. This vulnerability has a CVSS score of 4.3 (Medium), indicating a network-based attack requiring user interaction, with a low impact on integrity and no impact on confidentiality or availability. While no public exploit code exists (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, with multiple reports indicating it was actively exploited in the wild as a zero-day, notably in conjunction with NSO iPhone spyware. Apple addressed this issue in iOS 14.5, iPadOS 14.5, watchOS 7.4, and macOS Big Sur 11.3.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 14.5CPE matchmatch criteria | cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* | ||
< 14.5CPE matchmatch criteria | cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* | ||
>= 11.0, < 11.3CPE matchmatch criteria | cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.