A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.2, specifically within the Level Control cluster's periodic server tick logic. When a MoveToLevel command is sent and immediately followed by a write of OperationMode=2 (in the Pump Configuration and Control cluster), the server tick function violates the assertion `currentLevel < maxLevel`, resulting in a crash. This can be exploited remotely without authentication to cause denial of service. Affected versions include 1.3 and 1.4 (commit ab3d5ae).
Metrics
Affected Vendors & Products
No data.
No data.
No data.
References
History
Wed, 29 Jul 2026 07:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Reachable Assertion in Matter SDK Enables Unauthenticated Remote Denial of Service |
Sat, 25 Jul 2026 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Remote Denial of Service via Reachable Assertion in Matter SDK Level Control Cluster |
Thu, 23 Jul 2026 04:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Remote Denial of Service via Reachable Assertion in Matter SDK Level Control Cluster |
Fri, 17 Jul 2026 23:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Reachable Assertion in Matter SDK Causing Remote Denial of Service |
Thu, 16 Jul 2026 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Reachable Assertion in Matter SDK Causing Remote Denial of Service |
Wed, 15 Jul 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-617 | |
| Metrics |
cvssV3_1
|
Tue, 14 Jul 2026 22:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.2, specifically within the Level Control cluster's periodic server tick logic. When a MoveToLevel command is sent and immediately followed by a write of OperationMode=2 (in the Pump Configuration and Control cluster), the server tick function violates the assertion `currentLevel < maxLevel`, resulting in a crash. This can be exploited remotely without authentication to cause denial of service. Affected versions include 1.3 and 1.4 (commit ab3d5ae). | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2026-07-14T00:00:00.000Z
Updated: 2026-07-15T14:23:19.667Z
Reserved: 2025-08-16T00:00:00.000Z
Link: CVE-2025-56362
Vulnrichment
Updated: 2026-07-15T14:23:05.773Z
NVD
No data.
Redhat
No data.