What’s Vulnerable › Vulnerabilities

CVE-2014-2227

• Severity: medium (CVSS 6.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2014-07-25 · updated 2026-06-17
• Weakness: CWE-264

Description

The default Flash cross-domain policy (crossdomain.xml) in Ubiquiti Networks UniFi Video (formerly AirVision aka AirVision Controller) before 3.0.1 does not restrict access to the application, which allows remote attackers to bypass the Same Origin Policy via a crafted SWF file.

Affected products

• UniFi Video Controller (for Windows 7/8/10 x64): through 2.1.3

References

• http://seclists.org/fulldisclosure/2014/Jul/128
• http://sethsec.blogspot.com/2014/07/cve-2014-2227.html
• http://www.securityfocus.com/bid/68866
• http://seclists.org/fulldisclosure/2014/Jul/128
• http://sethsec.blogspot.com/2014/07/cve-2014-2227.html
• http://www.securityfocus.com/bid/68866

Get alerted when CVE-2014-2227 or the next vulnerability affects your stack