A reachable assertion within the Matter SDK’s Level Control cluster causes a server crash when a MoveToLevel command is followed immediately by a write to OperationMode=2 in the Pump Configuration and Control cluster. This flaw results in the assertion that the current level is less than the maximum level being violated, leading to an unhandled crash. The vulnerability can be exploited remotely without authentication to disrupt the operation of affected Matter devices, potentially impacting the availability of entire smart‑home systems.

Matter SDK (Project CHIP) versions prior to 1.4.2, including releases 1.3 and 1.4 identified by commit ab3d5ae, are susceptible. The flaw resides in the periodic server tick logic of the Level Control cluster and affects any device implementing this SDK version.

With a CVSS score of 7.5 and an EPSS score below 1%, the vulnerability poses a moderate‑severe threat but is currently unlikely to be widely exploited. It is not listed in the CISA KEV catalog, indicating no known large‑scale exploits at present. Attackers can trigger the condition remotely by issuing the two specific commands, so the vector is inferred to be network‑based and does not require local or authenticated access.