CVE-2026-89409: CWE-940 Improper Verification of Source of a Communication Channel in Silicon Labs Z-Wave SDK

The vulnerability CVE-2026-89409 in Silicon Labs Z-Wave SDK versions 7.0.0 to 8.1.1 (700/800 series) and up to 6.85.02 (500 series) is due to missing checks in the ZWAVE_CMD_NODES_EXIST handler. This handler fails to verify that messages instructing node removal come from devices already joined to the network, leading to potential unauthorized removal of nodes. The issue is categorized under CWE-940, which concerns improper verification of the source of a communication channel. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, and limited privileges required.

An attacker with limited privileges on the network could send crafted messages to the ZWAVE_CMD_NODES_EXIST handler to remove nodes from the Z-Wave network improperly. This could disrupt network operations by removing legitimate nodes without proper authorization. There is no indication of remote code execution or data disclosure. No known exploits are reported in the wild.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Z-Wave network to trusted devices only and monitor for unusual node removal activity.