CVE-2025-41016
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-24

Last updated on: 2025-11-24

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
Inadequate access control vulnerability in Davantis DFUSION v6.177.7, which allows unauthorised actors to extract images and videos related to alarm events through access to “/alarms/<ALARM_ID>/<MEDIA>”, where the “MEDIA” parameter can take the value of “snapshot” or “video.mp4”. These media files contain images recorded by security cameras in response to triggered alerts.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-24
Last Modified
2025-11-24
Generated
2026-05-07
AI Q&A
2025-11-24
EPSS Evaluated
2026-05-05
NVD
CVE-2025-41016
EUVD
EUVD-2025-198650
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
davantis dfusion 6.177.7
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is an inadequate access control issue in Davantis DFUSION v6.177.7 that allows unauthorized actors to access and extract images and videos related to alarm events. Specifically, attackers can access media files such as snapshots or video recordings through a URL path that includes the alarm ID and media type, which contain security camera footage triggered by alerts.


How can this vulnerability impact me? :

The vulnerability can lead to unauthorized disclosure of sensitive security camera footage, potentially compromising privacy and security by exposing images and videos related to alarm events to unauthorized individuals.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart