A use of uninitialized value vulnerability in the Matter SDK (connectedhomeip) before version 1.4.0 allows unauthenticated remote attackers to trigger a denial of service via an uninitialized destination group ID.

A use of uninitialized value vulnerability occurs when the GetDestinationGroupId().Value() method is called without validating whether a value exists, requiring no privileges and no user interaction over the network.

Successful exploitation of this vulnerability leads to a denial of service state, causing affected services or devices to crash via a SIGABRT signal. This can result in localized device downtime and potential disruption of smart home or IoT management systems. Although confidentiality and integrity are not compromised, the high CVSS score of 7.5 reflects the severity of potential service disruption across vulnerable deployments.

Immediate Action: Update the Matter SDK (connectedhomeip) to version 1.4.0 or apply commit 43aa98c2d30ee547c6b587b9de7bbb794f175ece to incorporate the required .HasValue() check.

Proactive Monitoring: Monitor network traffic and device telemetry for unusual frequency of InvokeCommand requests or recurring service restarts indicative of crash loops.

Compensating Controls: Implement network perimeter controls or firewalls to restrict inbound connections to trusted management sources and mitigate exposure to unauthorized API commands.

Public Exploit Available: No (As of the latest data, there is no confirmed public exploit available, though a proof-of-concept assessment exists).

Given the high severity and potential for unauthenticated remote denial of service, administrators must prioritize updating the Matter SDK to version 1.4.0. Applying the official fix prevents unexpected application crashes and ensures system resilience against malformed commands.