Inadequate Access Control Vulnerability in Davantis DFUSION Security Software

CVE-2025-41016

What is CVE-2025-41016?

An inadequate access control vulnerability in Davantis DFUSION v6.177.7 enables unauthorized individuals to gain access to sensitive media files, including images and videos linked to alarm events. By accessing the specific endpoint '/alarms/<ALARM_ID>/', where the MEDIA parameter can be specified as either 'snapshot' or 'video.mp4', attackers can extract recorded footage from security cameras that reacted to security alerts. This poses a serious risk as it allows potential attackers to retrieve private surveillance data without authentication.

References