CVE-2025-41016: Davantis DFUSION Access Control Flaw

CVE-2025-41016 Overview

CVE-2025-41016 is a missing authorization vulnerability [CWE-862] in Davantis DFUSION v6.177.7. The flaw allows unauthenticated remote attackers to retrieve alarm-related media files directly from the application. By requesting the path /alarms/<ALARM_ID>/<MEDIA>, where MEDIA is either snapshot or video.mp4, an attacker can download images and video recordings captured by connected security cameras when alerts are triggered.

Davantis DFUSION is a video analytics and perimeter protection platform used in physical security deployments. The exposed media represents footage from real alarm events, making the issue a direct breach of surveillance confidentiality.

Critical Impact
Unauthenticated attackers can enumerate alarm IDs and exfiltrate snapshot images and MP4 recordings captured by physical security cameras during alarm events.

Affected Products

Davantis DFUSION v6.177.7
DFUSION v6 alarm media endpoints (/alarms/<ALARM_ID>/snapshot, /alarms/<ALARM_ID>/video.mp4)
Surveillance camera footage stored and served by the affected DFUSION instance

Discovery Timeline

2025-11-24 - CVE-2025-41016 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-41016

Vulnerability Analysis

The vulnerability is a Broken Access Control issue mapped to [CWE-862] (Missing Authorization). The DFUSION web application exposes media resources tied to alarm events through a predictable URL pattern. The server does not verify that the requester is authenticated or authorized to view the requested alarm before returning the media payload.

A remote attacker who can reach the DFUSION HTTP service can issue direct GET requests against /alarms/<ALARM_ID>/snapshot or /alarms/<ALARM_ID>/video.mp4 to retrieve the corresponding image or video. Because alarm identifiers are sequential or otherwise enumerable, an attacker can iterate through ALARM_ID values and harvest every available recording. The disclosure affects confidentiality of surveillance footage but does not modify data or affect availability.

Root Cause

The root cause is the absence of an authorization check on the alarm media routes. The handler resolves the media file from the ALARM_ID parameter and streams it to the client without validating session state, user identity, or role membership. The application appears to rely on URL obscurity rather than enforced access control on these endpoints.

Attack Vector

Exploitation requires network access to the DFUSION management interface and no privileges or user interaction. An attacker enumerates ALARM_ID values in the URL path and downloads the associated snapshot JPEG or video.mp4 recording. The endpoints can be reached with any standard HTTP client, including a browser or curl. No verified public proof-of-concept code, ExploitDB entry, or CISA KEV listing is currently associated with this CVE.

No verified exploit code is available. See the INCIBE Security Notice for the vendor-coordinated disclosure details.

Detection Methods for CVE-2025-41016

Indicators of Compromise

HTTP GET requests to URI patterns matching /alarms/<number>/snapshot or /alarms/<number>/video.mp4 originating from unauthenticated sessions.
Sequential enumeration of ALARM_ID values from a single source IP within a short time window.
Outbound transfer of JPEG and MP4 content from the DFUSION host to non-corporate IP ranges.

Detection Strategies

Inspect DFUSION web server access logs for repeated /alarms/ requests without an associated authenticated session cookie or token.
Deploy a Web Application Firewall (WAF) rule that requires a valid authentication header on the /alarms/*/snapshot and /alarms/*/video.mp4 routes.
Correlate network flow data with web logs to identify large or repeated media downloads from the DFUSION application.

Monitoring Recommendations

Forward DFUSION HTTP access and error logs to a centralized SIEM for retention and alerting on anomalous URI patterns.
Alert on bursts of 4xx or 200 responses against /alarms/ endpoints exceeding a defined per-source threshold.
Monitor egress bandwidth from the DFUSION server, since bulk media exfiltration produces a measurable traffic profile.

How to Mitigate CVE-2025-41016

Immediate Actions Required

Restrict network access to the DFUSION web interface to trusted management subnets using firewall or VPN controls.
Contact Davantis to obtain a fixed build addressing the missing authorization check on alarm media endpoints.
Audit DFUSION access logs since deployment for prior unauthenticated requests to /alarms/*/snapshot and /alarms/*/video.mp4.
Rotate any credentials, API keys, or session tokens that may have been exposed alongside the alarm media.

Patch Information

No fixed version is published in the NVD record at the time of writing. Refer to the INCIBE Security Notice and contact Davantis support for a vendor-supplied update for DFUSION v6.177.7.

Workarounds

Place the DFUSION server behind a reverse proxy that enforces authentication on /alarms/* routes before requests reach the application.
Block external access to the DFUSION management interface at the perimeter firewall until a vendor patch is applied.
Apply network segmentation so that only authorized operator workstations can reach the DFUSION HTTP service.

bash

# Example NGINX reverse proxy snippet enforcing auth on alarm media endpoints
location ~ ^/alarms/[0-9]+/(snapshot|video\.mp4)$ {
    auth_request /_auth;
    proxy_pass http://dfusion_backend;
}

location = /_auth {
    internal;
    proxy_pass http://auth_service/validate;
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
    proxy_set_header X-Original-URI $request_uri;
}