A reachable assertion vulnerability exists in the Matter SDK connectedhomeip before version 1.4.2, allowing unauthenticated remote attackers to trigger a denial of service via service crashes.

This flaw involves a reachable assertion within the Level Control cluster periodic server tick logic, triggered by a MoveToLevel command followed by a specific Pump Configuration write, requiring no authentication.

A successful exploit results in application crashes and service unavailability for affected devices running the Matter SDK. This can lead to significant operational disruption in smart home or IoT environments. The assigned CVSS score of 7.5 reflects the high severity associated with remote, unauthenticated denial of service capabilities.

Immediate Action: Update the Matter SDK connectedhomeip to version 1.4.2 or later, or apply the upstream fix commit 871b4347b3b068dc161d6a02f867a0335cff13ed.

Proactive Monitoring: Monitor IoT infrastructure and device logs for sudden, repeated restarts or assertion failure crashes indicative of exploitation attempts.

Compensating Controls: Implement network segmentation to restrict untrusted access to vulnerable IoT management interfaces and services where feasible.

Public Exploit Available: No

Given the high severity and potential for widespread denial of service across connected devices, administrators must prioritize updating the Matter SDK to version 1.4.2. Applying the official patch or updating dependencies ensures that the assertion failure logic is properly corrected, neutralizing the crash vector.