CVE-2025-41017 Overview
CVE-2025-41017 is an inadequate access control vulnerability affecting Davantis DDFUSION v6.177.7. The flaw allows unauthenticated remote actors to retrieve perspective parameters from security camera settings. Attackers reach the exposed data by issuing HTTP requests to the /cameras/<CAMERA_ID>/perspective endpoint. The underlying weakness is a missing authorization check [CWE-862] on a resource that should require authenticated access. The issue was disclosed through an INCIBE security notice covering multiple vulnerabilities in DDFUSION.
Critical Impact
Unauthenticated network attackers can read perspective configuration parameters of security cameras managed by DDFUSION, exposing sensitive surveillance configuration data.
Affected Products
- Davantis DDFUSION v6.177.7
Discovery Timeline
- 2025-11-24 - CVE-2025-41017 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-41017
Vulnerability Analysis
The vulnerability is a Broken Access Control issue mapped to [CWE-862] Missing Authorization. The DDFUSION web interface exposes the endpoint /cameras/<CAMERA_ID>/perspective, which returns perspective parameters used to calibrate camera views. This endpoint does not enforce an authorization check before returning data. Any actor who can reach the DDFUSION service on the network can enumerate camera identifiers and pull configuration values.
Perspective parameters describe how the DDFUSION analytics engine interprets a camera's field of view. Disclosure of these values gives an attacker insight into physical camera positioning, calibration references, and analytic zones. That information supports reconnaissance for tampering with detection logic or planning physical evasion of monitored areas.
The attack is network-reachable, requires no privileges, and needs no user interaction. Exploitation only requires a valid CAMERA_ID value, which can be discovered by iteration or through other information disclosure paths in the same product.
Root Cause
The root cause is a missing server-side authorization control on the perspective resource. The application delivers configuration data based solely on the presence of the URL path, without verifying an authenticated session or role. Access control enforcement is absent at the route handler level.
Attack Vector
An attacker sends an HTTP GET request to /cameras/<CAMERA_ID>/perspective on a reachable DDFUSION instance. The server responds with perspective parameters without checking credentials. See the INCIBE Security Notice for details on the disclosed endpoints.
Detection Methods for CVE-2025-41017
Indicators of Compromise
- Unauthenticated HTTP GET requests to URIs matching the pattern /cameras/<CAMERA_ID>/perspective in DDFUSION web server logs.
- Sequential enumeration of numeric CAMERA_ID values from a single source IP address.
- Requests to camera configuration endpoints from IP ranges outside the expected management network.
Detection Strategies
- Parse DDFUSION HTTP access logs for requests to /cameras/*/perspective and correlate with authenticated session identifiers to flag anonymous access.
- Deploy web application firewall (WAF) rules that alert on access to camera perspective endpoints without a valid session cookie or authorization header.
- Use network intrusion detection signatures matching the URI path /cameras/ followed by an integer and /perspective on the DDFUSION service port.
Monitoring Recommendations
- Baseline normal request volume and source IPs against DDFUSION management interfaces and alert on deviations.
- Forward DDFUSION application and web server logs to a centralized SIEM for retention and correlation.
- Monitor for scanning behavior against video surveillance infrastructure segments.
How to Mitigate CVE-2025-41017
Immediate Actions Required
- Restrict network access to DDFUSION management interfaces to trusted administrative networks only.
- Place DDFUSION behind a reverse proxy or VPN that enforces authentication before requests reach the application.
- Audit recent web server logs for unauthenticated access to /cameras/<CAMERA_ID>/perspective endpoints.
- Contact Davantis support to confirm patch availability for DDFUSION v6.177.7.
Patch Information
At the time of publication, no vendor patch is referenced in the NVD entry for CVE-2025-41017. Refer to the INCIBE Security Notice for current vendor guidance and consult Davantis for a fixed release.
Workarounds
- Enforce network-level access control lists that permit DDFUSION access only from designated management hosts.
- Require VPN connectivity for any remote administration of the DDFUSION service.
- Disable exposure of the DDFUSION web interface to untrusted networks, including the public internet.
- Segment video surveillance systems onto isolated VLANs with strict egress and ingress filtering.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
