What’s Vulnerable › Vulnerabilities
CVE-2026-89409: Unvalidated ZWAVE_CMD_NODES_EXIST May Cause Deletion of End Nodes
- Severity: medium (CVSS 5.3 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-22 · updated 2026-10-22
- Weakness: CWE-940
Description
In Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices) and 6.85.02 and earlier (for 500 series devices), missing checks in the ZWAVE_CMD_NODES_EXIST handler can result in nodes being removed from the network. These messages must come from a device that has already joined the network.
Affected products
- Silicon Labs Z-Wave SDK: from 7.0.0 through 8.1.1; through 6.85.02
References
Get alerted when CVE-2026-89409 or the next vulnerability affects your stack