CVE-2025-56361

Katalog CVE

CVSS 5.7 · Medium EPSS 0,35%

Kerentanan Reachable Assertion pada csa-iot matter. Skor CVSS 3.1 5.7 (Medium) menurut NVD.

Deskripsi (NVD)

A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) 1.3 thru 1.4, specifically within the Level Control cluster's server tick logic (`emberAfLevelControlClusterServerTickCallback`). When a MoveToLevel command is executed and followed by a conflicting write to the OperationMode attribute (in the Pump Configuration and Control cluster), an invariant check (`minLevel < currentLevel`) fails and causes the device to abort. This leads to a denial of service condition. The issue is confirmed in SDK versions 1.3 and 1.4 (commit ab3d5ae), and is triggered remotely without authentication.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

13 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

5.7 (Medium), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-617: Reachable Assertion

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/project-chip/connectedhomeip/issues/38619 exploit · issue tracking
• https://github.com/project-chip/connectedhomeip/ product