Vulnerability Description
A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, affecting the ReadRevisionAttribute function used in multiple clusters (Channel, Account Login, TargetNavigator, etc.). The function lacks proper validation of the delegate pointer before dereferencing. A remote unauthenticated attacker can exploit this issue by sending a crafted read request, causing the device to crash (denial of service). This issue has been confirmed in SDK version v1.4 (commit ab3d5ae).
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Csa-Iot | Matter | < 1.4.0.0 |
Related Weaknesses (CWE)
References
- https://github.com/project-chip/connectedhomeip/Product
- https://github.com/project-chip/connectedhomeip/issues/39173ExploitIssue Tracking
- https://github.com/project-chip/connectedhomeip/issues/39173ExploitIssue Tracking
FAQ
What is CVE-2025-56363?
CVE-2025-56363 is a vulnerability with a CVSS score of 7.5 (HIGH). A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, affecting the ReadRevisionAttribute function used in multiple clusters (Channel, Account Login, Target...
How severe is CVE-2025-56363?
CVE-2025-56363 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-56363?
Check the references section above for vendor advisories and patch information. Affected products include: Csa-Iot Matter.