CVE-2025-56361
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A reachable assertion vulnerability in Matter SDK versions 1.3 and 1.4 causes device abort after a MoveToLevel command and conflicting write to the OperationMode attribute. The bug in Level Control cluster server tick logic leads to denial of service (DoS).
Risk Assessment
An unauthenticated remote attacker can crash Matter-based IoT devices, disrupting their operation and potentially the entire network.
Recommendation
Immediately update the Matter SDK to a version later than 1.4 that includes the fix. If update is not possible, restrict external access to the devices.
Other vulnerabilities in Matter SDK
See all- CVE-2025-56365High
A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before version 1.4.0, in the interaction model command processing logic. Sending an InvokeCommandRequest to a nonexistent endpoint and cluster (e.g., 0x34) causes the code to incorrectly treat the endpoint as valid due to missing checks in CodegenDataModelProvider::Invoke, leading to a VerifyOrDie failure in ProcessCommandDataIB and a crash (SIGABRT). The issue has been acknowledged and fixed in a later revision (PR #37207).
- CVE-2025-56364High
A use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip) before version 1.4.0. The `GetDestinationGroupId().Value()` method is called without checking if a value exists, leading to a crash when an InvokeCommand is sent without initializing the destination group ID.
- CVE-2025-56363High
A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before version 1.4.0, affecting the ReadRevisionAttribute function used in multiple clusters (Channel, Account Login, TargetNavigator, etc.). The function lacks proper validation of the delegate pointer before dereferencing. A remote unauthenticated attacker can exploit this issue by sending a crafted read request, causing the device to crash (denial of service).
- CVE-2025-56362High
A reachable assertion vulnerability in Matter SDK (connectedhomeip) before 1.4.2 allows remote denial of service by sending a MoveToLevel command followed by writing OperationMode=2 in the Pump Configuration and Control cluster, causing a server crash.
Original NVD description (English source)
A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) 1.3 thru 1.4, specifically within the Level Control cluster's server tick logic (`emberAfLevelControlClusterServerTickCallback`). When a MoveToLevel command is executed and followed by a conflicting write to the OperationMode attribute (in the Pump Configuration and Control cluster), an invariant check (`minLevel < currentLevel`) fails and causes the device to abort. This leads to a denial of service condition. The issue is confirmed in SDK versions 1.3 and 1.4 (commit ab3d5ae), and is triggered remotely without authentication.