CVE-2026-89410

MediumCVSS 5.1

Published: 22/10/2026(UTC)Updated: 23/10/2026(UTC)Translated: 22/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigger out-of-bounds reads that leak sensitive information.

Risk Assessment

An attacker could exploit the leak to obtain sensitive information from device memory, potentially facilitating further attacks on the Z-Wave network.

Recommendation

Update Z-Wave SDK to a version later than 8.1.1 and restrict the ability to send malformed NCP SPI commands to devices.

Other vulnerabilities in Z-Wave SDK

CVE-2026-89409Medium
In Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices) and 6.85.02 and earlier (for 500 series devices), missing checks in the ZWAVE_CMD_NODES_EXIST handler can result in nodes being removed from the network. These messages must come from a device that has already joined the network.

Original NVD description (English source)

In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigger out-of-bounds reads that leak sensitive information.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS