Executive brief
A security vulnerability exists in the Matter SDK, a widely used software toolkit for smart home devices like light bulbs, thermostats, and locks. An attacker can remotely crash a smart device by sending a specific sequence of commands that confuse the device's internal logic for managing levels (such as brightness or pump speed). This results in a denial-of-service, rendering the smart home hardware unresponsive until it is manually restarted or recovered.
Technical details
A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before version 1.4.2 within the Level Control cluster's periodic server tick logic (emberAfLevelControlClusterServerTickCallback). The flaw is triggered when a MoveToLevel command is initiated (scheduling a ramp-up of the CurrentLevel attribute) and is immediately followed by a write to the OperationMode attribute in the Pump Configuration and Control cluster. This sequence causes the CurrentLevel to jump to its maximum value instantly, violating the internal invariant 'currentLevel < maxLevel' during the next scheduled tick. An unauthenticated remote attacker can exploit this to cause a process crash (SIGABRT), resulting in a denial of service.
Affected products
- Project CHIP Matter SDK (connectedhomeip) 1.3, 1.4 before 1.4.2
Timeline
- 2025-04-25: disclosed: Issue reported on GitHub
- 2026-07-14: advisory: CVE published