CVE-2014-2227 EXPLOIT
6.0
MEDIUM · CVSS 2.0 · EPSS 2.2% (pctl 82)
Patch early
A public exploit exists.
Description
The default Flash cross-domain policy (crossdomain.xml) in Ubiquiti Networks UniFi Video (formerly AirVision aka AirVision Controller) before 3.0.1 does not restrict access to the application, which allows remote attackers to bypass the Same Origin Policy via a crafted SWF file.
Scoring
| CVSS | 6.0 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:S/C:P/I:P/A:P |
| EPSS | 2.17% — more likely to be exploited than 82% of all CVEs |
| Weakness | CWE-264 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2014-07-25 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| ui | unifi video |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Ubiquiti Networks UniFi Video Default - 'crossdomain.xml' Security Bypass | 2014-07-23 |
References
→ the Explorer · watch your stack · NVD