CVE-2025-41016: Davantis Dfusion

High severity, CVSS 8.7. EPSS: 0.3% chance of exploitation in the next 30 days.

Inadequate access control vulnerability in Davantis DFUSION v6.177.7, which allows unauthorised actors to extract images and videos related to alarm events through access to “/alarms/<ALARM_ID>/<MEDIA>”, where the “MEDIA” parameter can take the value of “snapshot” or “video.mp4”. These media files contain images recorded by security cameras in response to triggered alerts.

Affected products

• Davantis Dfusion: before 6.186.1 (fixed in 6.186.1)

Published 2025-11-24. Last modified 2026-06-17.