CVE-2025-41016 — Multiple vulnerabilities in DFUSION by Davantis

CVE-2025-41016

Multiple vulnerabilities in DFUSION by Davantis PUBLISHED

Description (CNA)

Inadequate access control vulnerability in Davantis DFUSION v6.177.7, which allows unauthorised actors to extract images and videos related to alarm events through access to “/alarms/<ALARM_ID>/<MEDIA>”, where the “MEDIA” parameter can take the value of “snapshot” or “video.mp4”. These media files contain images recorded by security cameras in response to triggered alerts.

Affected (CNA)

Vendor / product	Versions
Davantis / DFUSION	affected prior to 6.186.1

CWE

CWE-862

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-dfusion-davantis

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.