CVE-2025-56361 Overview
CVE-2025-56361 is a reachable assertion vulnerability [CWE-617] in the Matter SDK (connectedhomeip) versions 1.3 through 1.4. The flaw resides in the Level Control cluster's server tick logic, specifically the emberAfLevelControlClusterServerTickCallback function. An attacker sends a MoveToLevel command followed by a conflicting write to the OperationMode attribute in the Pump Configuration and Control cluster. This sequence violates the minLevel < currentLevel invariant, forcing the device to abort. The vulnerability is triggered remotely without authentication and produces a denial of service condition on affected Matter devices.
Critical Impact
Unauthenticated remote attackers can crash Matter-enabled IoT devices, disrupting smart home and building automation deployments that rely on the affected SDK.
Affected Products
- CSA-IoT Matter SDK (connectedhomeip) version 1.3.0.0
- CSA-IoT Matter SDK (connectedhomeip) version 1.4.0.0 (commit ab3d5ae)
- Matter-certified devices implementing the Level Control and Pump Configuration and Control clusters
Discovery Timeline
- 2026-07-14 - CVE-2025-56361 published to NVD
- 2026-07-17 - Last updated in NVD database
Technical Details for CVE-2025-56361
Vulnerability Analysis
The vulnerability originates in the Matter SDK's Level Control cluster server logic. The emberAfLevelControlClusterServerTickCallback function enforces an invariant that minLevel must remain less than currentLevel during level transitions. When a MoveToLevel command is in flight, a subsequent write to the OperationMode attribute inside the Pump Configuration and Control cluster mutates state that the tick callback depends on. The invariant check fails and the device aborts execution.
Because Matter is designed for consumer and commercial IoT ecosystems, the abort halts device functionality until a manual reboot or watchdog recovery. Affected devices include smart lighting, HVAC controllers, and pump systems that expose both clusters. See GitHub Issue #38619 for reproduction details.
Root Cause
The root cause is a missing cross-cluster synchronization check. The Level Control cluster tick callback assumes attributes governed by the Pump Configuration and Control cluster remain stable during a level transition. There is no defensive validation before the assertion, so any conflicting write reaches an unreachable-by-design code path and terminates the process.
Attack Vector
The attack is network-reachable and requires no authentication in Matter deployments where the attacker has already joined the fabric or where commissioning is exposed. An adversary sends the following sequence over the Matter protocol:
- Issue a MoveToLevel command to the target endpoint hosting the Level Control cluster.
- Immediately issue an attribute write to OperationMode on the Pump Configuration and Control cluster on the same device.
- Wait for the server tick to fire and trigger the failed assertion.
The vulnerability manifests deterministically once the request ordering is achieved. Refer to the connectedhomeip repository for the affected source paths.
Detection Methods for CVE-2025-56361
Indicators of Compromise
- Unexpected device reboots or abort logs referencing emberAfLevelControlClusterServerTickCallback
- Assertion failure messages containing minLevel < currentLevel in device serial or syslog output
- Repeated Matter cluster command sequences pairing MoveToLevel with OperationMode writes from the same fabric node
Detection Strategies
- Monitor Matter fabric traffic for anomalous back-to-back command patterns targeting Level Control and Pump Configuration and Control clusters on the same endpoint
- Correlate device availability drops with preceding Matter cluster write operations in centralized logs
- Alert when the same Matter node repeatedly triggers device restarts across multiple endpoints
Monitoring Recommendations
- Forward Matter device crash logs and hub telemetry to a centralized logging platform for cross-device correlation
- Track uptime metrics per IoT device and baseline expected reboot frequency
- Enable verbose Matter protocol logging on border routers during investigation windows
How to Mitigate CVE-2025-56361
Immediate Actions Required
- Inventory all Matter devices running SDK versions 1.3 and 1.4 and identify those exposing the Level Control and Pump Configuration and Control clusters
- Restrict Matter fabric membership to trusted commissioners and disable open commissioning windows when not in active use
- Segment Matter Thread and Wi-Fi networks from untrusted client devices using VLANs or dedicated SSIDs
Patch Information
No vendor patch is listed in the NVD entry at publication time. Monitor the connectedhomeip repository and GitHub Issue #38619 for upstream fixes. Device manufacturers must integrate the corrected SDK and distribute firmware updates to end users.
Workarounds
- Disable the Pump Configuration and Control cluster on devices where it is not functionally required
- Apply access control list (ACL) entries in Matter to limit which nodes can write to the OperationMode attribute
- Deploy watchdog-based auto-recovery on Matter devices to minimize downtime after an abort
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
