Z-Wave SDK CVE-2026-89409

Exploitation requires the attacker to already be a device that has joined the target Z-Wave network (a paired/authenticated mesh node), as stated explicitly in the description; a crafted ZWAVE_CMD_NODES_EXIST message is then accepted by the handler due to missing source/authorization checks, causing node removal. The key limiting factor is this prerequisite network membership (reflected as PR:L) - an arbitrary unpaired or internet-based attacker cannot trigger it, which substantially narrows the realistic threat to a compromised or malicious already-joined device. Affected only on Z-Wave SDK 8.1.1 and earlier (700/800 series) and 6.85.02 and earlier (500 series).

This is a medium-severity, authenticated-insider issue rather than a widely-exploitable critical flaw. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) and score of 5.3 align with the description: the handler weakness affects integrity and availability only (VI:L/VA:L, VC:N - no confidentiality), and PR:L plus the explicit statement that 'these messages must come from a device that has already joined the network' confirm the attacker must be an already-paired node on the Z-Wave mesh, not an arbitrary remote party. The vuln.today decision label is this_month, not act_now or emergency, consistent with a moderate priority. No EPSS score, no CISA KEV listing, and no proof-of-concept were supplied; the only reference is a Silicon Labs vendor advisory. CWE-940 (improper verification of source of a communication channel) matches the root cause - the handler fails to properly validate/authorize the request before removing nodes. One data conflict to flag: the input tags the issue as 'Information Disclosure,' but the mechanism (nodes removed from the network) and the CVSS impact (VC:N, integrity/availability only) are a network-manipulation/denial issue, not disclosure - treat the tag as mislabeled.

An attacker who already controls or has compromised a device paired to the target Z-Wave network sends crafted ZWAVE_CMD_NODES_EXIST messages. Because the handler lacks proper source/authorization checks, the controller or receiving device removes legitimate nodes from the network, disrupting the mesh (e.g., knocking sensors, locks, or alarms offline). No public exploit identified at time of analysis; exploitation is limited to an entity already joined to the network.