EUVD-2025-210469
GHSA-qj9w-vfqp-8pcv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain access to device Matter fabric
-
DeliverySend MoveToLevel command
-
ExploitWrite OperationMode=2 to Pump Config cluster
-
ExecutionServer tick violates currentLevel<maxLevel assertion
-
ImpactProcess aborts, device DoS
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
|
| Exploitation Conditions | Exploitation requires a target device that implements BOTH the Level Control cluster and the Pump Configuration and Control cluster, plus the specific two-step sequence: a MoveToLevel command followed immediately by a write of OperationMode=2, which must land before/around the periodic server tick that evaluates currentLevel < maxLevel. Limiting factors: the crash only manifests on the next server tick, the OperationMode=2 write is mandatory (a MoveToLevel alone is insufficient), and although NVD marks PR:N, issuing these cluster operations in practice requires an established Matter session, which normally means membership in the device's fabric - so realistic exploitation is gated on fabric/commissioning access rather than being open to any unauthenticated remote host. Devices that do not expose the Pump Configuration and Control cluster are not affected. |
| Impact | The signals are internally consistent for a high-availability-impact DoS but not a code-execution or data-exposure threat: the CVSS vector (AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H) yields 7.5 driven entirely by availability. No EPSS score is provided, there is no KEV listing, and no POC is referenced, so this is a real but non-urgent bug rather than an actively exploited priority. One important caveat: the NVD vector claims PR:N (unauthenticated), yet issuing Matter cluster operations such as MoveToLevel and attribute writes normally requires an authenticated CASE session as a member of the device's Matter fabric - so realistic exploitation likely requires prior commissioning/fabric access rather than arbitrary internet-facing attackers. Verify this authentication precondition with the vendor; if fabric membership is required, real-world exposure is narrower than PR:N implies. Impact is limited to a crash/reboot, with no confidentiality or integrity consequence. |
| Exploit ScenarioDerived | An attacker with access to the device's Matter fabric (for example a rogue controller admitted during multi-admin commissioning, or a compromised host on the local smart-home network) sends a MoveToLevel command to a vulnerable device and immediately writes OperationMode=2 to its Pump Configuration and Control cluster. On the next periodic server tick the currentLevel < maxLevel assertion fails and the device process aborts, dropping the device offline until it restarts. Given AC:L the sequence is simple to reproduce and can be repeated to sustain the outage; no public POC is currently referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 15, 2026
Remotely triggerable denial of service in the Matter SDK (connectedhomeip) before 1.4.2 lets an attacker crash devices by driving the Level Control cluster's periodic server tick into a failed assertion (currentLevel < maxLevel). Sending a MoveToLevel command and immediately writing OperationMode=2 in the Pump Configuration and Control cluster produces an inconsistent internal state that aborts the process. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; CVSS is 7.5 with availability-only impact.
RemediationAI
Vendor-released patch: 1.4.2 - upgrade the embedded Matter SDK to 1.4.2 or later and rebuild/reflash affected device firmware, tracking status via https://github.com/project-chip/connectedhomeip/issues/38618. Because most impact reaches shipped devices through downstream firmware, downstream OEMs must pull the fixed SDK and issue OTA updates; end users cannot patch the library directly. Where immediate patching is impossible, reduce exposure by restricting which fabrics and controllers can reach affected devices (avoid multi-admin commissioning of untrusted controllers), and by not exposing the Pump Configuration and Control cluster on devices that do not genuinely need it, since the OperationMode write is a required trigger - note this removes legitimate pump-mode functionality. Segmenting the smart-home VLAN limits which hosts can open Matter sessions, at the cost of added deployment complexity.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Matter (formerly Project CHIP / connectedhomeip) reference SDK, the cross-vendor implementation underlying most Matter-certified smart-home devices. The bug lives in the Level Control cluster's periodic server tick, which advances a device's brightness/level state over time; the Pump Configuration and Control cluster's OperationMode attribute feeds into the min/max bounds used by that logic. Writing OperationMode=2 concurrently with an in-flight MoveToLevel operation leaves currentLevel above the effective maxLevel, so the tick handler's C-style assertion currentLevel < maxLevel fails. This is a classic CWE-617 Reachable Assertion: attacker-influenced input reaches an assert() that aborts the program instead of handling the error state gracefully.
Know when Matter gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Sending MoveToLevel and attribute writes requires an authenticated Matter fabric session, so PR:L rather than PR:N; the deterministic two-step trigger gives AC:L, and impact is availability-only (A:H, C:N/I:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.2, specifically within the Level Control cluster's periodic server tick logic. When a MoveToLevel command is sent and immediately followed by a write of OperationMode=2 (in the Pump Configuration and Control cluster), the server tick function violates the assertion currentLevel < maxLevel, resulting in a crash. This can be exploited remotely without authentication to cause denial of service. Affected versions include 1.3 and 1.4 (commit ab3d5ae).
Executive ViewAI
Matter SDK (connectedhomeip) versions before 1.4.2 contain a remotely triggerable denial of service vulnerability affecting smart home devices and IoT infrastructure. An unauthenticated attacker can crash connected devices by sending specific cluster commands, disrupting device availability and potentially affecting dependent automation workflows or user-facing services.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict Matter device network access to trusted subnets only, implement API rate limiting on cluster state changes, disable non-essential clusters on affected devices, and monitor device logs for repeated assertion failures indicating exploitation attempts. Prepare for urgent upgrade deployment once vendor releases patched version 1.4.2 or later.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Remote privilege escalation in Android Thread networking protocol implementation via out-of-bounds write. No additional
An issue in the Certificate Authenticated Session Establishment (CASE) protocol for establishing secure sessions between
Denial of service in the Matter SDK (connectedhomeip) before 1.4.0 lets a remote unauthenticated attacker crash a smart-
Remote denial of service in the Matter SDK (connectedhomeip) versions 1.3 through 1.4 lets unauthenticated attackers cra
Denial of service in the Matter SDK (connectedhomeip) before 1.4.0 lets a network attacker crash the device by sending a
Denial of service in the Matter SDK (connectedhomeip) before version 1.4.0 allows remote attackers to crash a Matter dev
Local information disclosure in the Matter Chip (connectedhomeip) controller lets an attacker who already holds low priv
An implementation issue in the Connectivity Standards Alliance Matter 1.2 protocol as used in the connectedhomeip SDK al
Exploit-DB