Auth bypass in Davantis Dfusion
CVE-2025-41016
Inadequate access control vulnerability in Davantis DFUSION v6.177.7, which allows unauthorised actors to extract images and videos related to alarm events through access to “/alarms/<ALARM_ID>/<MEDIA>”, where the “MEDIA” parameter can take the value of “snapshot” or “video.mp4”. These media files contain images recorded by security cameras in response to triggered alerts.
Vulnerability class: Broken Access Control
EPSS: 0.003 (20.1th percentile) — read the EPSS interpretation.
Affected products
- Davantis Dfusion — versions prior to 6.186.1