All vulnerabilities
CVE-2026-89409

Z-Wave SDK: Unvalidated ZWAVE_CMD_NODES_EXIST May Cause Deletion of End Nodes​

Silicon Labs Z-Wave SDK
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 18% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published22 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

In Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices) and 6.85.02 and earlier (for 500 series devices), missing checks in the ZWAVE_CMD_NODES_EXIST handler can result in nodes being removed from the network. These messages must come from a device that has already joined the network.

Text from CVE List

Affected versions 2

  • Z-Wave SDKaffected: 7.0.0 through 8.1.1CVE List
  • Z-Wave SDKaffected: all versions through 6.85.02CVE List

References 1