CyberRota Analysis
AI-GeneratedThe Matter SDK (connectedhomeip) versions prior to 1.4.0 are vulnerable due to a flaw in the interaction model command processing logic, where sending an InvokeCommandRequest to a nonexistent endpoint and cluster can lead to a crash (SIGABRT) due to inadequate validation checks. This high-severity vulnerability could disrupt services relying on the SDK, making it critical for developers and organizations using this software to prioritize updating to the patched version. Immediate action is recommended to mitigate potential service interruptions and maintain system stability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, in the interaction model command processing logic. When an InvokeCommandRequest is sent to a nonexistent endpoint and cluster (e.g., 0x34), the code incorrectly treats the endpoint as valid due to missing checks in CodegenDataModelProvider::Invoke. This causes a VerifyOrDie failure in ProcessCommandDataIB and results in a crash (SIGABRT). The issue has been acknowledged and fixed in a later revision (PR #37207).
Related CVEs
Other vulnerabilities affecting the same vendor(s)