Matter SDK CVE-2025-56365

The concrete trigger is an InvokeCommandRequest whose interaction-model path references an endpoint/cluster that does not exist on the device (the description cites cluster 0x34); the vulnerable code in CodegenDataModelProvider::Invoke fails to verify cluster existence on the endpoint before dispatch, so no special device feature toggle is required beyond normal command processing. Limiting factors: exploitation requires the ability to send interaction-model commands to the target, which in a normal Matter deployment means network reachability plus an established secure session on the commissioned fabric - the CVSS marks PR:N, but if the assertion is only reachable after session/ACL processing then fabric membership is effectively a prerequisite; impact is confined to availability (device crash/reboot), with no data disclosure or code execution, and any watchdog auto-restart shortens the outage.

Signals are internally consistent for a denial-of-service issue: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects a network-reachable, low-complexity crash with availability-only impact and no confidentiality or integrity loss, matching the 'Denial Of Service' tag and CWE-617. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so this is not evidence of active or widespread exploitation - it is a code-quality/robustness defect with a clear upstream fix rather than a high-urgency RCE. One caveat to verify: the CVSS lists PR:N (unauthenticated), but delivering an InvokeCommandRequest to a Matter device normally requires an established secure session on the commissioned fabric, so real-world exploitation likely presupposes fabric access unless the assertion triggers before access-control checks - confirm the pre-ACL reachability with the vendor. Overall this is a moderate-priority availability bug: worth patching, especially for exposed or shared-fabric deployments, but not a drop-everything emergency absent exploitation signals.

An attacker with network reachability to a vulnerable Matter device (typically a peer on the same commissioned fabric or local network) sends a single crafted InvokeCommandRequest addressed to a nonexistent endpoint and cluster such as 0x34. The missing path validation lets the request reach the VerifyOrDie assertion, aborting the process with SIGABRT and taking the device offline; given AC:L and no user interaction, the request can be scripted and repeated to keep the device down. No public POC is currently identified, but the trigger is simple to reproduce from the description.