CyberRota Analysis
AI-GeneratedA reachable assertion vulnerability in the Matter SDK versions 1.3 and 1.4 allows remote attackers to exploit the Level Control cluster's server tick logic, leading to a denial of service when conflicting commands are issued. This issue can be triggered without authentication, making it critical for developers and manufacturers of IoT devices using these SDK versions to prioritize remediation efforts to prevent potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) 1.3 thru 1.4, specifically within the Level Control cluster's server tick logic (`emberAfLevelControlClusterServerTickCallback`). When a MoveToLevel command is executed and followed by a conflicting write to the OperationMode attribute (in the Pump Configuration and Control cluster), an invariant check (`minLevel < currentLevel`) fails and causes the device to abort. This leads to a denial of service condition. The issue is confirmed in SDK versions 1.3 and 1.4 (commit ab3d5ae), and is triggered remotely without authentication.
Related CVEs
Other vulnerabilities affecting the same vendor(s)