CVE-2025-56362

A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.2, specifically within the Level Control cluster's periodic server tick logic. When a MoveToLevel command is sent and immediately followed by a write of OperationMode=2 (in the Pump Configuration and Control cluster), the server tick function violates the assertion `currentLevel < maxLevel`, resulting in a crash. This can be exploited remotely without authentication to cause denial of service. Affected versions include 1.3 and 1.4 (commit ab3d5ae).

CVSS v3 5.7 MEDIUM

5.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/project-chip/connectedhomeip/	Product
https://github.com/project-chip/connectedhomeip/issues/38618	Exploit Issue Tracking
https://github.com/project-chip/connectedhomeip/issues/38618	Exploit Issue Tracking

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:csa-iot:matter:1.3.0.0:::::::*
	cpe:2.3:a:csa-iot:matter:1.4.0.0:::::::*

History

13 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de aserción alcanzable existe en el SDK de Matter (connectedhomeip) anterior a 1.4.2, específicamente dentro de la lógica de tic periódico del servidor del clúster de Control de Nivel. Cuando se envía un comando MoveToLevel e inmediatamente seguido por una escritura de OperationMode=2 (en el clúster de Configuración y Control de Bomba), la función de tic del servidor viola la aserción 'currentLevel menor que maxLevel', lo que resulta en un fallo. Esto puede ser explotado remotamente sin autenticación para causar denegación de servicio. Las versiones afectadas incluyen 1.3 y 1.4 (commit ab3d5ae).

05 Oct 2026, 18:17

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~7.5~~	v2 : unknown v3 : 5.7

Information

Published : 2026-07-14 23:17

Updated : 2026-10-13 10:10

NVD link : CVE-2025-56362

Mitre link : CVE-2025-56362

CVE.ORG link : CVE-2025-56362

JSON object : View

Products Affected

csa-iot

matter

CWE

CWE-617

Reachable Assertion

{"id": "CVE-2025-56362", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-56362", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-05T17:46:06.918797Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.1}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.1}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-07-14T23:17:27.193", "references": [{"url": "https://github.com/project-chip/connectedhomeip/", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/project-chip/connectedhomeip/issues/38618", "tags": ["Exploit", "Issue Tracking"], "source": "cve@mitre.org"}, {"url": "https://github.com/project-chip/connectedhomeip/issues/38618", "tags": ["Exploit", "Issue Tracking"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-617"}]}], "descriptions": [{"lang": "en", "value": "A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.2, specifically within the Level Control cluster's periodic server tick logic. When a MoveToLevel command is sent and immediately followed by a write of OperationMode=2 (in the Pump Configuration and Control cluster), the server tick function violates the assertion `currentLevel < maxLevel`, resulting in a crash. This can be exploited remotely without authentication to cause denial of service. Affected versions include 1.3 and 1.4 (commit ab3d5ae)."}, {"lang": "es", "value": "Una vulnerabilidad de aserci\u00f3n alcanzable existe en el SDK de Matter (connectedhomeip) anterior a 1.4.2, espec\u00edficamente dentro de la l\u00f3gica de tic peri\u00f3dico del servidor del cl\u00faster de Control de Nivel. Cuando se env\u00eda un comando MoveToLevel e inmediatamente seguido por una escritura de OperationMode=2 (en el cl\u00faster de Configuraci\u00f3n y Control de Bomba), la funci\u00f3n de tic del servidor viola la aserci\u00f3n 'currentLevel menor que maxLevel', lo que resulta en un fallo. Esto puede ser explotado remotamente sin autenticaci\u00f3n para causar denegaci\u00f3n de servicio. Las versiones afectadas incluyen 1.3 y 1.4 (commit ab3d5ae)."}], "lastModified": "2026-10-13T10:10:00.193", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:csa-iot:matter:1.3.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A6D746B5-004E-4814-AE0B-D1BEB41CCC31"}, {"criteria": "cpe:2.3:a:csa-iot:matter:1.4.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EFB8807D-427E-45D7-AA06-B872B38BBF16"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}