Reachable Assertion Vulnerability in Matter SDK by Connectivity Standards Alliance

CVE-2025-56362

What is CVE-2025-56362?

A reachable assertion vulnerability is present in the Matter SDK (connectedhomeip) prior to version 1.4.2. This flaw resides in the Level Control cluster's periodic server tick logic. Specifically, when the MoveToLevel command is executed followed by the write of OperationMode=2 in the Pump Configuration and Control cluster, it leads to a failure of the assertion currentLevel < maxLevel. This can be exploited remotely without requiring any authentication, resulting in potential service crashes and denial of service. Affected versions include 1.3 and 1.4 (commit ab3d5ae).

References