A high severity reachable assertion vulnerability in the Matter SDK (connectedhomeip) before version 1.4.0 allows unauthenticated remote attackers to trigger application crashes and denial of service.

A reachable assertion flaw exists in the interaction model command processing logic within CodegenDataModelProvider::Invoke, requiring no privileges and no user interaction by an unauthenticated network attacker.

Successful exploitation of this vulnerability results in a denial of service condition through application crashes via SIGABRT. This can disrupt smart home ecosystem communications and connected device availability, leading to operational downtime and administrative overhead. The CVSS score of 7.5 reflects the high availability impact achievable over the network without requiring any authentication.

Immediate Action: Update the Matter SDK (connectedhomeip) to version 1.4.0 or later, or apply the fix from pull request 37207.

Proactive Monitoring: Monitor connected device logs for unexpected application crashes, repeated service restarts, or anomalous InvokeCommandRequest traffic patterns.

Compensating Controls: Implement network segmentation and strict firewall rules to restrict unauthorized access to smart home management interfaces and Matter controller endpoints.

Public Exploit Available: false

Security teams managing implementations of the Matter SDK must prioritize updating to version 1.4.0 immediately. Applying this patch removes the flawed command validation logic and prevents unauthenticated remote actors from triggering denial of service crashes.