Reachable Assertion Vulnerability in Matter SDK by Connectivity Standards Alliance
CVE-2025-56361

7.5HIGH

Key Information:

Vendor

Connectivity Standards Alliance

Status
Matter SDK
Vendor
CVE Published:
14 July 2026

What is CVE-2025-56361?

A reachable assertion vulnerability in the Matter SDK (versions 1.3 and 1.4) exists due to a flaw in the Level Control cluster's server tick logic. When a MoveToLevel command is issued followed by a conflicting modification to the OperationMode attribute in the Pump Configuration and Control cluster, the invariant check fails. This issue can be triggered remotely and results in a denial of service condition, causing the device to abort its operations.

References

https://github.com/project-chip/connectedhomeip/issues/38619
https://github.com/project-chip/connectedhomeip/

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.