TI-2025-35312 Aliases CVE-2025-56361 GHSA-f6px-4w9c-rj4f

A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) 1.3 thru…

MEDIUM 59CWE-617Published 2026-07-14 · Updated 2026-10-05

Key facts

Attack vector: Adjacent network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-617.

Summary

A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) 1.3 thru 1.4, specifically within the Level Control cluster's server tick logic (`emberAfLevelControlClusterServerTickCallback`). When a MoveToLevel command is executed and followed by a conflicting write to the OperationMode attribute (in the Pump Configuration and Control cluster), an invariant check (`minLevel < currentLevel`) fails and causes the device to abort. This leads to a denial of service condition. The issue is confirmed in SDK versions 1.3 and 1.4 (commit ab3d5ae), and is triggered remotely without authentication.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00293 22nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:csa-iot:matter:1.3.0.0:::::::*	1.3.0.0	Vulnerable	Csa-iot
cpe:2.3:a:csa-iot:matter:1.4.0.0:::::::*	1.4.0.0	Vulnerable	Csa-iot

cpe:2.3:a:csa-iot:matter:1.3.0.0:*:*:*:*:*:*:* Versions 1.3.0.0 Vulnerable ·Csa-iot
cpe:2.3:a:csa-iot:matter:1.4.0.0:*:*:*:*:*:*:* Versions 1.4.0.0 Vulnerable ·Csa-iot

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-56361
2026-10-03 Alias added: GHSA-f6px-4w9c-rj4f
2026-10-05 CVSS score changed · CISA ADP
2026-10-05 CISA SSVC decision points changed
2026-10-05 Priority changed: HIGH → MEDIUM
2026-10-05 CVSS score added · NVD

References

Exploit 1

https://github.com/project-chip/connectedhomeip/issues/38619

Other 1

https://github.com/project-chip/connectedhomeip/

TI-2025-35316 A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before… CVSS 3.1MEDIUM 5.7
TI-2025-35315 A use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip)… CVSS 3.1MEDIUM 5.7
TI-2025-35314 A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip)… CVSS 3.1MEDIUM 5.7
TI-2025-35313 A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before… CVSS 3.1MEDIUM 5.7
TI-2024-03091 Session establishment lock-up during replay of CASE Sigma1 messages CVSS 3.1MEDIUM 6.5
TI-2024-03219 In-Fabric Matter Cluster Attribute Disclosure CVSS 3.1LOW 3.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences