Matter SDK EUVD-2025-210468

Exploitation requires the target device to implement BOTH the Level Control cluster and the Pump Configuration and Control cluster on a reachable endpoint, and the attacker must issue a MoveToLevel command and then a conflicting write to the OperationMode attribute during the window while the level transition is active. The CVSS vector is AV:N/AC:L/PR:N/UI:N, so no authentication or user interaction is asserted by the score; however, Matter operational messaging normally presumes the sender is commissioned onto the device's fabric, which is a practical limiting factor. The primary limiter is that only Matter devices exposing the Pump Configuration and Control cluster (pump-type products) built on connectedhomeip 1.3-1.4 are affected, so devices without that cluster are not exploitable via this path.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the description: remotely reachable, low complexity, no authentication, pure availability impact with no confidentiality or integrity loss. This is a genuine availability concern but not code execution or data exposure, so 7.5 reflects a DoS-only ceiling rather than critical compromise. It is not in CISA KEV and no public exploit or POC is referenced, so this is not confirmed active exploitation. No EPSS score or SSVC decision data was provided, so automatability and real-world exploitation probability cannot be quantified from the input. One caveat: triggering the assertion requires a specific interaction between the Level Control and Pump Configuration and Control clusters, so realistically only devices that actually expose the Pump Configuration and Control cluster (pump-type endpoints) are affected - the raw AC:L may understate this practical prerequisite.

An attacker with access to the Matter fabric or local network sends a MoveToLevel command to a vulnerable device to start a level transition, then immediately writes a conflicting value to the OperationMode attribute in the Pump Configuration and Control cluster. The overlapping operations violate the minLevel < currentLevel invariant during the next server tick, the assertion fires, and the device aborts - knocking the node offline until it restarts and enabling repeated on-demand crashes. No public POC is referenced, but the low attack complexity makes reliable reproduction plausible for anyone able to reach the device.