CVE-2025-56363

Katalog CVE

CVSS 5.7 · Medium EPSS 0,42%

Kerentanan NULL Pointer Dereference pada csa-iot matter. Skor CVSS 3.1 5.7 (Medium) menurut NVD.

Deskripsi (NVD)

A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, affecting the ReadRevisionAttribute function used in multiple clusters (Channel, Account Login, TargetNavigator, etc.). The function lacks proper validation of the delegate pointer before dereferencing. A remote unauthenticated attacker can exploit this issue by sending a crafted read request, causing the device to crash (denial of service). This issue has been confirmed in SDK version v1.4 (commit ab3d5ae).

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

13 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

5.7 (Medium), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-476: NULL Pointer Dereference

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/project-chip/connectedhomeip/issues/39173 exploit · issue tracking
• https://github.com/project-chip/connectedhomeip/ product