5.3
Medium
CVE-2026-89409 In Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices) and 6.85.02 and earlier (for 500 series devices), missing…
Description
In Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices) and 6.85.02 and earlier (for 500 series devices), missing checks in the ZWAVE_CMD_NODES_EXIST handler can result in nodes being removed from the network. These messages must come from a device that has already joined the network.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Z-Wave SDK 7.0 | 7.0.0 → 8.1.1 | No fix stated |
| Z-Wave SDK 6.85 | earliest → 6.85.02 | No fix stated |
Other CVEs of Z-Wave SDK
The 4 CVEs of Z-Wave SDK →
CVE-2026-89410
In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigger out-of-bounds reads that leak sensitive…
5.1
Medium
CVE-2024-22472
A buffer Overflow vulnerability in Silicon Labs 500 Series Z-Wave devices may allow Denial of Service, and potential…
8.1
High
CVE-2023-51395
The vulnerability described by CVE-2023-0972 has been additionally discovered in Silicon Labs Z-Wave end devices
8.8
High