CVE-2025-56361

Name of the Vulnerable Software and Affected Versions Matter SDK (connectedhomeip) versions 1.3 through 1.4

Description A reachable assertion issue exists within the Level Control cluster's server tick logic emberAfLevelControlClusterServerTickCallback(). A denial of service condition occurs when a MoveToLevel command is executed and followed by a conflicting write to the OperationMode attribute in the Pump Configuration and Control cluster. This sequence causes an invariant check minLevel < currentLevel to fail, leading the device to abort. This condition can be triggered remotely without authentication.

Recommendations Update Matter SDK (connectedhomeip) versions 1.3 through 1.4 to a newer version that resolves this assertion failure.