A reachable assertion in the Matter SDK (connectedhomeip) Level Control cluster’s server tick logic causes a device to crash when a MoveToLevel command is sent and immediately followed by a conflicting write to the Pump Configuration and Control cluster’s OperationMode attribute. The assertion verifies that the minimum level is less than the current level; when this check fails the server throws an assertion and aborts, leading to an immediate denial of service. The vulnerability can be triggered remotely without authentication.

The flaw affects Matter SDK versions 1.3 and 1.4, which are used in a wide range of home‑automation devices that implement the Level Control cluster. Any product or controller that incorporates these SDK releases is potentially impacted. The issue is confirmed in the open‑source Project CHIP repository at commit ab3d5ae.

The CVSS score of 7.5 places the vulnerability in the high severity range. With a very low EPSS score (<1%), exploitation is currently considered unlikely, but the remote, unauthenticated trigger makes it a candidate for targeted attacks. The vulnerability is not yet included in CISA’s KEV catalog. An attacker could exploit it by sending a MoveToLevel command followed immediately by a write to the OperationMode attribute, causing the device to crash and lose service.