> CVE-2025-56362

« BACK_TO_HOME
PUBLISHED
2026-07-14 23:17
MODIFIED
2026-07-14 23:17
EPSS (Prob. Exploit)
0.28%
Top 80.9%
DATA SOURCES:
NVD 🔗 2026-07-15 FIRST EPSS 🔗 2026-10-25 OSV 🔗 2026-07-19

> DESCRIPTION

A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.2, specifically within the Level Control cluster's periodic server tick logic. When a MoveToLevel command is sent and immediately followed by a write of OperationMode=2 (in the Pump Configuration and Control cluster), the server tick function violates the assertion `currentLevel < maxLevel`, resulting in a crash. This can be exploited remotely without authentication to cause denial of service. Affected versions include 1.3 and 1.4 (commit ab3d5ae).

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:
Unknown / Unknown
3 versions affected

> HISTORIQUE DES MODIFICATIONS

Première apparition
14/07/2026 23:17
Source: NVD
Total des modifications: 0 Dernière mise à jour: 3 months ago

> REFERENCES

https://github.com/project-chip/connectedhomeip/
https://github.com/project-chip/connectedhomeip/issues/38618
« BACK_TO_HOME