CVE-2026-23005 – Matter Commissioning Code Brute‑Force Without Rate Limit

Program Code (Python Matter simulation)

# matter_commissioning_sim.py
import random
real_code = random.randint(10000000, 99999999)

def attempt_join(code_attempt):
    # Simulate joining: no delay, no lockout
    if code_attempt == real_code:
        print("Joined successfully!")
        return True
    return False

# Brute-force all 8-digit codes (10^8)
for code in range(10000000, 100000000):
    if attempt_join(code):
        break

CVE-2026-23005 – Matter Commissioning Code Brute‑Force

Overview

A Matter device accepts commissioning attempts with an 8‑digit setup code but imposes no rate‑limiting or lockout after failed attempts. An attacker in proximity can brute‑force the entire code space within a few hours and join the network without physical access to the device.

Vulnerability Details

• Type: Brute‑Force / No Rate Limiting
• Impact: Unauthorized network access, device takeover.
• Root Cause: The commissioning protocol does not mandate a minimum interval or failure lockout, and the implementation allows unlimited attempts.

Exploit Demonstration

Run the simulation (it will take time, but conceptually):

python matter_commissioning_sim.py

It eventually finds the correct code.