EUVD-2025-210470
GHSA-mv6q-v23c-9757
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local network access to Matter fabric
-
DeliveryCraft revision-attribute read request
-
ExploitTarget cluster with null delegate (Channel/TargetNavigator)
-
ExecutionTrigger null pointer dereference
-
PersistDevice firmware crashes
-
ImpactDevice offline (denial of service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reach to a device running a pre-1.4.0 Matter SDK build that exposes at least one cluster using ReadRevisionAttribute (Channel, Account Login, TargetNavigator, and similar), and the ability to send a Matter Interaction Model read request for the revision attribute along a code path where the cluster delegate pointer is null. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is needed and complexity is low. The principal limiting factor is reachability: Matter nodes normally sit on a local Wi-Fi/Thread network behind a border router/controller rather than being directly internet-exposed, so the attacker must be on or bridged into that local fabric; impact is limited to a crash/reboot (availability only) with no data or code-execution consequence. |
| Impact | The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting a high-availability-impact, network-reachable, unauthenticated, low-complexity attack - the vector is internally consistent with the description of a remote unauthenticated crash. However, impact is strictly availability: no confidentiality or integrity loss, no code execution, so this is a reliability/DoS issue rather than a compromise vector. No EPSS score, no CISA KEV listing, and no SSVC decision data were provided, and no public exploit was identified, so exploitation appears theoretical/proof-not-public at this time. The practical risk is bounded by network exposure: Matter devices are typically on a local Wi-Fi/Thread network behind a border router, so 'network' reachability is usually LAN-adjacent rather than internet-wide, which meaningfully lowers real-world urgency for most home deployments despite the 7.5 score. |
| Exploit ScenarioDerived | An attacker with access to the local network segment hosting a Matter device sends a crafted Interaction Model read request targeting the revision attribute of a cluster (e.g., Channel or TargetNavigator) whose delegate is unset. The SDK dereferences the null delegate pointer and the device firmware crashes, dropping the device offline until it reboots. Repeating the request can produce a sustained denial of service; no public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 15, 2026
Denial of service in the Matter SDK (connectedhomeip) before 1.4.0 lets a remote unauthenticated attacker crash a smart-home device by sending a crafted read request. The flaw lives in the ReadRevisionAttribute function, which is reused across multiple clusters (Channel, Account Login, TargetNavigator), so any device exposing those clusters is affected. No public exploit identified at time of analysis, and the issue is availability-only (no code execution or data exposure).
RemediationAI
Upgrade the embedded Matter SDK to connectedhomeip version 1.4.0 or later, which contains the delegate null-check fix, and rebuild/re-flash affected device firmware; downstream device owners should apply vendor firmware updates that incorporate the 1.4.0 SDK. Track upstream discussion at https://github.com/project-chip/connectedhomeip/issues/39173 to confirm the patched build. Where firmware cannot be updated immediately, reduce exposure by isolating Matter devices on a segmented IoT VLAN and restricting which controllers/nodes can send Interaction Model read requests to the affected clusters, so untrusted local hosts cannot reach the vulnerable read path - note this does not fix the bug and can interfere with legitimate multi-admin/commissioning flows. Disabling or not exposing the affected media clusters (Channel, Account Login, TargetNavigator) on devices that do not need them also removes the vulnerable attack surface, at the cost of losing that cluster's functionality. Reference the NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2025-56363 .
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Matter (formerly Project CHIP, connectedhomeip) is the open, IP-based smart-home interoperability standard governed by the Connectivity Standards Alliance; its C++ reference SDK is embedded in countless commercial IoT products. The vulnerability is CWE-476 (NULL Pointer Dereference): the shared ReadRevisionAttribute helper dereferences a cluster 'delegate' pointer without first checking that it is non-null. When a read is issued for a cluster's revision attribute in a code path where the delegate was never registered or initialized, the dereference of the null pointer faults and terminates the device firmware. Because ReadRevisionAttribute is a common utility invoked by several application clusters, the single root-cause bug has a broad blast radius across the SDK's cluster implementations.
Know when Matter gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated crafted read triggers a crash with no auth or interaction (AV:N/AC:L/PR:N/UI:N), and impact is availability-only, so C:N/I:N/A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, affecting the ReadRevisionAttribute function used in multiple clusters (Channel, Account Login, TargetNavigator, etc.). The function lacks proper validation of the delegate pointer before dereferencing. A remote unauthenticated attacker can exploit this issue by sending a crafted read request, causing the device to crash (denial of service). This issue has been confirmed in SDK version v1.4 (commit ab3d5ae).
Executive ViewAI
The Matter SDK (connectedhomeip) versions before 1.4.0 contain a denial-of-service vulnerability allowing remote unauthenticated attackers to crash smart-home devices through crafted read requests. Organizations deploying Matter-based home automation face device unavailability and loss of operational control, directly impacting facility management and occupant experience.
Network segmentation isolating Matter devices to trusted subnets; firewall rules blocking unauthenticated remote access; continuous monitoring and alerting for abnormal device traffic and unexpected read requests to vulnerable clusters; rate-limiting at network boundaries where feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Remote privilege escalation in Android Thread networking protocol implementation via out-of-bounds write. No additional
An issue in the Certificate Authenticated Session Establishment (CASE) protocol for establishing secure sessions between
Remotely triggerable denial of service in the Matter SDK (connectedhomeip) before 1.4.2 lets an attacker crash devices b
Remote denial of service in the Matter SDK (connectedhomeip) versions 1.3 through 1.4 lets unauthenticated attackers cra
Denial of service in the Matter SDK (connectedhomeip) before 1.4.0 lets a network attacker crash the device by sending a
Denial of service in the Matter SDK (connectedhomeip) before version 1.4.0 allows remote attackers to crash a Matter dev
Local information disclosure in the Matter Chip (connectedhomeip) controller lets an attacker who already holds low priv
An implementation issue in the Connectivity Standards Alliance Matter 1.2 protocol as used in the connectedhomeip SDK al
Exploit-DB