CVE-2025-56363: Csa-iot Matter SDK DoS Vulnerability

CVE-2025-56363 Overview

CVE-2025-56363 is a null pointer dereference vulnerability [CWE-476] in the Matter SDK (connectedhomeip) maintained by the Connectivity Standards Alliance (CSA-IoT). The flaw resides in the ReadRevisionAttribute function, which is shared across multiple clusters including Channel, Account Login, and TargetNavigator. The function dereferences a delegate pointer without validating that it is non-null. A remote, unauthenticated attacker can send a crafted read request over the network to trigger the crash. The issue affects Matter SDK versions before 1.4.0 and has been confirmed in v1.4 at commit ab3d5ae.

Critical Impact
A single crafted Matter read request from an unauthenticated network attacker crashes affected devices, disrupting availability across smart home and IoT deployments that rely on the Matter protocol.

Affected Products

CSA-IoT Matter SDK (connectedhomeip) versions before 1.4.0
Matter SDK v1.4 at commit ab3d5ae (confirmed)
Devices implementing Channel, Account Login, TargetNavigator, and other clusters that invoke ReadRevisionAttribute

Discovery Timeline

2026-07-14 - CVE-2025-56363 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2025-56363

Vulnerability Analysis

The vulnerability affects the Matter SDK, an open-source implementation of the Matter smart home interoperability standard. The ReadRevisionAttribute function is used by multiple Matter clusters to return cluster revision metadata during attribute read operations. Each cluster registers a delegate object that provides the underlying implementation. When the SDK processes an incoming read request, it calls ReadRevisionAttribute and dereferences the delegate pointer directly to obtain the revision value.

Because the function performs no null check on the delegate, any read against a cluster whose delegate has not been initialized causes the process to dereference a null address. The result is an immediate crash of the Matter service, terminating the device's Matter fabric participation. This is a classic availability defect that maps to CWE-476 (NULL Pointer Dereference).

Root Cause

The root cause is missing input validation before pointer dereference. The ReadRevisionAttribute implementation assumes that a valid delegate has been registered for every cluster instance that exposes it. When the delegate pointer is null, the code path proceeds without a guard and reads from address 0x0, causing a segmentation fault or equivalent fault on constrained embedded targets.

Attack Vector

The attack requires no authentication, no user interaction, and no privileges. An attacker on the same network as a Matter device sends a crafted attribute read request targeting an affected cluster such as Channel, Account Login, or TargetNavigator. The device processes the request, invokes ReadRevisionAttribute, and crashes. Repeated requests keep the device unavailable, producing a persistent denial-of-service condition against smart home hubs, TVs, and other Matter endpoints.

No verified public proof-of-concept code is available at the time of publication. Refer to the GitHub Issue #39173 and the Connected Home IP repository for technical discussion.

Detection Methods for CVE-2025-56363

Indicators of Compromise

Unexpected restarts or crashes of Matter-enabled devices immediately after receiving inbound attribute read traffic
Matter service logs terminating during processing of read requests against Channel, Account Login, or TargetNavigator clusters
Repeated loss of Matter fabric connectivity on affected endpoints without corresponding configuration changes

Detection Strategies

Monitor Matter device logs and crash telemetry for segmentation faults or null pointer faults originating in ReadRevisionAttribute
Inspect network traffic on Matter operational ports for unexpected bursts of attribute read requests targeting cluster revision attributes
Correlate device reboots across multiple Matter endpoints, which suggests a broadcast or scanning attack rather than isolated hardware issues

Monitoring Recommendations

Enable verbose logging on Matter controllers and hubs to capture the cluster and attribute identifiers of inbound read requests
Track device availability metrics for Matter endpoints and alert on repeated disconnect and reconnect cycles
Baseline normal Matter traffic patterns within the local network segment so anomalous read request volumes can be identified

How to Mitigate CVE-2025-56363

Immediate Actions Required

Upgrade all Matter SDK builds to version 1.4.0 or later and redeploy firmware to affected devices
Segment Matter devices onto an isolated VLAN or IoT network to limit which hosts can reach them with attribute read requests
Inventory devices built on connectedhomeip and identify those exposing Channel, Account Login, or TargetNavigator clusters

Patch Information

The issue is resolved in Matter SDK version 1.4.0. Device manufacturers and integrators using the connectedhomeip codebase should rebase onto the fixed release and ship updated firmware. Track the fix and related discussion in the Connected Home IP repository and GitHub Issue #39173.

Workarounds

Restrict network access to Matter devices using firewall rules that permit only trusted controllers to send attribute read requests
Disable optional clusters such as Channel, Account Login, and TargetNavigator on devices where they are not required by the application
Where source access is available, add a null check on the delegate pointer inside ReadRevisionAttribute before dereferencing as a temporary hardening measure until the official patch is deployed

bash

# Example: isolate Matter devices on a dedicated IoT VLAN and restrict inbound access
# Replace interfaces and subnets with values from your environment
iptables -A FORWARD -i vlan_iot -o vlan_iot -p udp --dport 5540 -j ACCEPT
iptables -A FORWARD -o vlan_iot -p udp --dport 5540 -s 10.10.20.0/24 -j ACCEPT
iptables -A FORWARD -o vlan_iot -p udp --dport 5540 -j DROP