Matter SDK EUVD-2025-210471

Exploitation requires the attacker to send a groupcast (multicast) InvokeCommand message to a Matter node running connectedhomeip before 1.4.0/commit 0360cc3, with the packet header's destination GroupId left uninitialized so that GetDestinationGroupId() holds no value - this specific malformed groupcast frame IS the trigger. Per the CVSS vector no authentication (PR:N), user interaction (UI:N), or special product configuration is needed beyond the device processing groupcast traffic, and complexity is low (AC:L). The main limiting factor is reachability: groupcast/group messaging in Matter is generally scoped to the local link/fabric, so the attacker realistically needs a foothold on the same network segment (LAN, Wi-Fi, or Thread mesh) as the target rather than arbitrary internet access; impact is limited to availability (process crash), with no data disclosure or modification.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent for a remotely triggerable, unauthenticated, low-complexity crash with pure availability impact and no confidentiality or integrity loss - an accurate 'HIGH availability-only' profile rather than an inflated code-execution claim. No EPSS score, KEV listing, or SSVC decision data was supplied, so exploitation probability cannot be quantified from the input; there is no public exploit identified at time of analysis. Practical risk is moderated by reachability: groupcast traffic is typically confined to the local IPv6 link/mesh of a Matter fabric rather than the open internet, so 'network' here usually means an attacker already on the same LAN/Thread/Wi-Fi segment. Real-world priority is therefore situational - meaningful for exposed or multi-tenant IoT deployments where an on-network actor can disrupt home-automation availability, but not a mass-exploitation candidate. Note: AV:N reflects the protocol layer, while realistic exploitation is effectively link-local - verify network exposure in your deployment.

An attacker with access to the local Matter network segment (Wi-Fi, Thread mesh, or the same IPv6 link) crafts a groupcast InvokeCommand message whose packet header omits the destination group ID and sends it to a target device or controller. When ExchangeManager processes the message and calls Value() on the empty optional, the process aborts with SIGABRT, dropping the node offline. No exploit code is publicly identified, but the low attack complexity (AC:L) and lack of authentication (PR:N) make crafting such a malformed packet straightforward for an on-network adversary.