CVE-2025-41016
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-24

Last updated on: 2025-11-24

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
Inadequate access control vulnerability in Davantis DFUSION v6.177.7, which allows unauthorised actors to extract images and videos related to alarm events through access to “/alarms/<ALARM_ID>/<MEDIA>”, where the “MEDIA” parameter can take the value of “snapshot” or “video.mp4”. These media files contain images recorded by security cameras in response to triggered alerts.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-24
Last Modified
2025-11-24
Generated
2026-06-16
AI Q&A
2025-11-24
EPSS Evaluated
2026-06-15
NVD
CVE-2025-41016
EUVD
EUVD-2025-198650
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
davantis dfusion 6.177.7
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an inadequate access control issue in Davantis DFUSION v6.177.7 that allows unauthorized actors to access and extract images and videos related to alarm events. Specifically, attackers can access media files such as snapshots or video recordings through a URL path that includes the alarm ID and media type, which contain security camera footage triggered by alerts.

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive security camera footage, potentially compromising privacy and security by exposing images and videos related to alarm events to unauthorized individuals.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-41016. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart