Z-Wave SDK EUVD-2026-108187

Exploitation requires physical, board-level access to the device's NCP (Network Co-Processor) SPI bus - the serial interface between the host MCU and the Z-Wave radio - over which the attacker sends a malformed SPI command (AV:P). No software authentication is needed (PR:N) and no user interaction is required (UI:N), but the physical-access requirement is the dominant limiting factor: the flaw is not reachable over the Z-Wave RF network or any IP network from the provided vector. Affected scope is Z-Wave SDK version 8.1.1 and earlier. The precise malformed-command structure that triggers the out-of-bounds read is not described in the available sources.

This is a moderate, access-gated information-disclosure flaw rather than a top-tier emergency. The provided CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:N/VC:H) scores 5.1 and is driven almost entirely by the high confidentiality impact (VC:H); the Physical attack vector (AV:P) is what keeps the score moderate. Critically, the vector attacks the NCP (Network Co-Processor) SPI bus - an inter-chip serial interface on the device board - so a real attacker needs physical/hardware-level access to the host-to-radio SPI link, not network reachability. PR:N means no software credentials are required, but that is subordinate to the physical-access requirement. Signal alignment: the vendor-derived priority is 'this_month' (not act_now/emergency), there is no CISA KEV listing, and no EPSS probability was supplied in the input. No public exploit was identified in the provided data. The absence of EPSS leaves one standard exploitation-likelihood signal missing - this should be noted, not assumed low. Overall the signals are consistent: a genuine confidentiality bug that matters for threat models including local hardware tampering, supply-chain, or lab-access adversaries, but low urgency for remote mass-exploitation because of the physical vector.

An attacker with physical access to a Z-Wave device's circuit board connects to the NCP SPI bus linking the host controller and the Z-Wave radio, then issues a malformed SPI command that triggers out-of-bounds reads, causing the SDK to return adjacent memory contents and leak sensitive information such as keys or network state. No public exploit code was identified in the provided data, and the specific trigger mechanics beyond 'malformed NCP SPI command' are not detailed in the available sources.