CVE-2025-56363
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before version 1.4.0, affecting the ReadRevisionAttribute function used in multiple clusters (Channel, Account Login, TargetNavigator, etc.). The function lacks proper validation of the delegate pointer before dereferencing. A remote unauthenticated attacker can exploit this issue by sending a crafted read request, causing the device to crash (denial of service).
Risk Assessment
The risk is that a remote attacker can crash IoT devices using the vulnerable SDK version, leading to service disruption in home or industrial automation systems.
Recommendation
Immediately update the Matter SDK to version 1.4.0 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Matter SDK
See all- CVE-2025-56365High
A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before version 1.4.0, in the interaction model command processing logic. Sending an InvokeCommandRequest to a nonexistent endpoint and cluster (e.g., 0x34) causes the code to incorrectly treat the endpoint as valid due to missing checks in CodegenDataModelProvider::Invoke, leading to a VerifyOrDie failure in ProcessCommandDataIB and a crash (SIGABRT). The issue has been acknowledged and fixed in a later revision (PR #37207).
- CVE-2025-56364High
A use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip) before version 1.4.0. The `GetDestinationGroupId().Value()` method is called without checking if a value exists, leading to a crash when an InvokeCommand is sent without initializing the destination group ID.
- CVE-2025-56362High
A reachable assertion vulnerability in Matter SDK (connectedhomeip) before 1.4.2 allows remote denial of service by sending a MoveToLevel command followed by writing OperationMode=2 in the Pump Configuration and Control cluster, causing a server crash.
- CVE-2025-56361High
A reachable assertion vulnerability in Matter SDK versions 1.3 and 1.4 causes device abort after a MoveToLevel command and conflicting write to the OperationMode attribute. The bug in Level Control cluster server tick logic leads to denial of service (DoS).
Original NVD description (English source)
A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, affecting the ReadRevisionAttribute function used in multiple clusters (Channel, Account Login, TargetNavigator, etc.). The function lacks proper validation of the delegate pointer before dereferencing. A remote unauthenticated attacker can exploit this issue by sending a crafted read request, causing the device to crash (denial of service). This issue has been confirmed in SDK version v1.4 (commit ab3d5ae).