CVE-2025-56365
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before version 1.4.0, in the interaction model command processing logic. Sending an InvokeCommandRequest to a nonexistent endpoint and cluster (e.g., 0x34) causes the code to incorrectly treat the endpoint as valid due to missing checks in CodegenDataModelProvider::Invoke, leading to a VerifyOrDie failure in ProcessCommandDataIB and a crash (SIGABRT). The issue has been acknowledged and fixed in a later revision (PR #37207).
Risk Assessment
An attacker can remotely crash an IoT device running a vulnerable version of the Matter SDK, causing a denial of service (DoS) and potentially disrupting normal device operation in a smart home network.
Recommendation
Immediately update the Matter SDK library to version 1.4.0 or later, which includes the fix (PR #37207). If an update is not possible, restrict network access to the device interface to trusted sources only.
Other vulnerabilities in Matter SDK
See all- CVE-2025-56364High
A use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip) before version 1.4.0. The `GetDestinationGroupId().Value()` method is called without checking if a value exists, leading to a crash when an InvokeCommand is sent without initializing the destination group ID.
- CVE-2025-56363High
A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before version 1.4.0, affecting the ReadRevisionAttribute function used in multiple clusters (Channel, Account Login, TargetNavigator, etc.). The function lacks proper validation of the delegate pointer before dereferencing. A remote unauthenticated attacker can exploit this issue by sending a crafted read request, causing the device to crash (denial of service).
- CVE-2025-56362High
A reachable assertion vulnerability in Matter SDK (connectedhomeip) before 1.4.2 allows remote denial of service by sending a MoveToLevel command followed by writing OperationMode=2 in the Pump Configuration and Control cluster, causing a server crash.
- CVE-2025-56361High
A reachable assertion vulnerability in Matter SDK versions 1.3 and 1.4 causes device abort after a MoveToLevel command and conflicting write to the OperationMode attribute. The bug in Level Control cluster server tick logic leads to denial of service (DoS).
Original NVD description (English source)
A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, in the interaction model command processing logic. When an InvokeCommandRequest is sent to a nonexistent endpoint and cluster (e.g., 0x34), the code incorrectly treats the endpoint as valid due to missing checks in CodegenDataModelProvider::Invoke. This causes a VerifyOrDie failure in ProcessCommandDataIB and results in a crash (SIGABRT). The issue has been acknowledged and fixed in a later revision (PR #37207).