Davantis DFUSION Inadequate Access Control Vulnerability Allowing Unauthorized Media Access

An access control vulnerability has been identified in Davantis DFUSION version 6.177.7. This vulnerability allows unauthorized individuals to access and extract images and videos related to alarm events. The issue arises from inadequate access controls on the media files, which can be accessed through a specific URL pattern. The 'MEDIA' parameter in the URL can be replaced with 'snapshot' or 'video.mp4', enabling access to images or video recordings captured by security cameras in response to alarm events.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive media files, including images and videos recorded by security cameras during alarm events.

Remediation

Users can upgrade to Davantis DFUSION version 6.186.1 or later to address this vulnerability.