Vulnerability · Published Nov 24, 2025 · Assigned by INCIBE

CVE-2025-41016Multiple vulnerabilities in DFUSION by Davantis

High 8.7

In plain English

A high-severity missing authorization in DFUSION from Davantis. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.3%top 76.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Inadequate access control vulnerability in Davantis DFUSION v6.177.7, which allows unauthorised actors to extract images and videos related to alarm events through access to “/alarms/<ALARM_ID>/<MEDIA>”, where the “MEDIA” parameter can take the value of “snapshot” or “video.mp4”. These media files contain images recorded by security cameras in response to triggered alerts.

Affected products (as reported)

Vendor	Product	Versions
Davantis	DFUSION	prior to 6.186.1

Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-dfusion-davantis