CVE-2026-89409: Unvalidated ZWAVE_CMD_NODES_EXIST May Cause Deletion of End Nodes
Published Oct 22, 2026
·Updated
In Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices) and 6.85.02 and earlier (for 500 series devices), missing checks in the ZWAVECMDNODESEXIST handler can result in nodes being removed from the network. These messages must come from a device that has already joined the network.
Affected Software
1 affected component
Silicon Labs Z-Wave SDK<=8.1.1, <=6.85.02
Event History
Oct 22, 2026
CVE Published
via MITRE·01:50 PM
Data Sourced
via MITRE·01:50 PM
DescriptionWeakness
Frequently Asked Questions
1
Which devices and SDK branches are affected?
The issue affects 700/800 series devices using Z-Wave SDK 8.1.1 or earlier, and 500 series devices using Z-Wave SDK 6.85.02 or earlier.
2
Does an attacker need to join the Z-Wave network first?
Yes. The affected ZWAVE_CMD_NODES_EXIST messages must originate from a device that has already joined the network.