Z-Wave SDK Vulnerability in IoT Devices by Silicon Labs

CVE-2026-89409

What is CVE-2026-89409?

In earlier versions of the Z-Wave SDK, particularly 8.1.1 for 700/800 series devices and 6.85.02 for 500 series devices, a vulnerability exists in the ZWAVE_CMD_NODES_EXIST command handler. The absence of necessary checks allows for the removal of nodes from the network under certain conditions. This flaw can result in unauthorized devices being manipulated, raising concerns for secure network operations. Ensuring that proper validation mechanisms are in place is crucial to maintain the integrity of Z-Wave network communications.

References