Description
Inadequate access control vulnerability in Davantis DFUSION v6.177.7, which allows unauthorised actors to extract images and videos related to alarm events through access to “/alarms/<ALARM_ID>/<MEDIA>”, where the “MEDIA” parameter can take the value of “snapshot” or “video.mp4”. These media files contain images recorded by security cameras in response to triggered alerts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Davantis | DFUSION | prior to 6.186.1 | — |