← Back

CVE-2025-56365

nvd nist
Published: Jul 14, 2026Modified: Jul 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, in the interaction model command processing logic. When an InvokeCommandRequest is sent to a nonexistent endpoint and cluster (e.g., 0x34), the code incorrectly treats the endpoint as valid due to missing checks in CodegenDataModelProvider::Invoke. This causes a VerifyOrDie failure in ProcessCommandDataIB and results in a crash (SIGABRT). The issue has been acknowledged and fixed in a later revision (PR #37207).

Affected (1)

Products: Csa Iot: Matter
Csa Iot
1 product
Matter
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Matter
Before 1.4.0.0

Related CWEs

CWE-617
Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References (4)

Source: cve@mitre.org
Product
Source: cve@mitre.org
ExploitIssue Tracking
Source: cve@mitre.org
Patch
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
ExploitIssue Tracking

Timeline

No history available yet.