CVE-2025-56362

Katalog CVE

CVSS 5.7 · Medium EPSS 0,33%

Kerentanan Reachable Assertion pada csa-iot matter. Skor CVSS 3.1 5.7 (Medium) menurut NVD.

Deskripsi (NVD)

A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.2, specifically within the Level Control cluster's periodic server tick logic. When a MoveToLevel command is sent and immediately followed by a write of OperationMode=2 (in the Pump Configuration and Control cluster), the server tick function violates the assertion `currentLevel < maxLevel`, resulting in a crash. This can be exploited remotely without authentication to cause denial of service. Affected versions include 1.3 and 1.4 (commit ab3d5ae).

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

13 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

5.7 (Medium), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-617: Reachable Assertion

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 23,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/project-chip/connectedhomeip/issues/38618 exploit · issue tracking
• https://github.com/project-chip/connectedhomeip/ product