CVE-2026-89409
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
In Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices) and 6.85.02 and earlier (for 500 series devices), missing checks in the ZWAVE_CMD_NODES_EXIST handler can result in nodes being removed from the network. These messages must come from a device that has already joined the network.
Risk Assessment
A malicious or compromised device in the network could cause other nodes to be removed, disrupting Z-Wave network operation.
Recommendation
Update Z-Wave SDK to a version later than 8.1.1 (700/800 series) or 6.85.02 (500 series) and monitor for unusual node removals.
Other vulnerabilities in Z-Wave SDK
Original NVD description (English source)
In Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices) and 6.85.02 and earlier (for 500 series devices), missing checks in the ZWAVE_CMD_NODES_EXIST handler can result in nodes being removed from the network. These messages must come from a device that has already joined the network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS