Executive brief
A security vulnerability exists in the Matter SDK, a widely used software framework for smart home devices. An attacker can remotely crash a smart device by sending a specific sequence of commands that causes the device's internal software to fail an integrity check. This results in a denial of service, rendering the smart device unresponsive until it is manually restarted or recovered.
Technical details
A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) within the Level Control cluster's server tick logic (emberAfLevelControlClusterServerTickCallback). The issue is triggered when a MoveToLevel command is initiated, followed by a conflicting write to the OperationMode attribute in the Pump Configuration and Control cluster. This sequence causes an invariant check (minLevel < currentLevel) to fail, leading to a process abort and denial of service. The vulnerability can be exploited remotely without authentication and affects SDK versions 1.3 and 1.4 (specifically confirmed at commit ab3d5ae).
Affected products
- Connectivity Standards Alliance Matter SDK (connectedhomeip) 1.3 to 1.4 (commit ab3d5ae)
Timeline
- 2025-04-25: disclosed: Issue reported on GitHub repository
- 2026-07-14: advisory: NVD publication date