CVE-2022-24611

CVE-2022-24611 Details regarding the Z-Wave S0-No-More attack. For a full analysis and report how this works and how to reproduce the findings see the attached PDF file. Short description: Denial of Service attack against S0 and S2 devices tested with the Z- Wave ZW5xx product line, here...

CVE-2026-89409

In Z-Wave SDK 8.1.1 and earlier for 700/800 series devices and 6.85.02 and earlier for 500 series devices, missing checks in the ZWAVECMDNODESEXIST handler can result in nodes being removed from the network. These messages must come from a device that has already joined the network...

CVE-2026-89410

In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigger out-of-bounds reads that leak sensitive information...

CVE-2026-89410 Out-of-bounds read in Z-Wave NCP SPI Handler

In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigger out-of-bounds reads that leak sensitive information...

EUVD-2026-108187

In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigger out-of-bounds reads that leak sensitive information...

CVE-2026-89410

The Z-Wave SDK version 8.1.1 and earlier is vulnerable to an out-of-bounds read in the NCP SPI Handler . A malformed NCP SPI command can trigger this condition, potentially leading to the leak of sensitive information . The vulnerability is associated with CWE-1285 (Improper Validation of Specifi...

CVE-2026-89410 Out-of-bounds read in Z-Wave NCP SPI Handler

In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigger out-of-bounds reads that leak sensitive information...

EUVD-2026-108186

In Z-Wave SDK 8.1.1 and earlier for 700/800 series devices and 6.85.02 and earlier for 500 series devices, missing checks in the ZWAVECMDNODESEXIST handler can result in nodes being removed from the network. These messages must come from a device that has already joined the network...

CVE-2026-89409 Unvalidated ZWAVE_CMD_NODES_EXIST May Cause Deletion of End Nodes​

In Z-Wave SDK 8.1.1 and earlier for 700/800 series devices and 6.85.02 and earlier for 500 series devices, missing checks in the ZWAVECMDNODESEXIST handler can result in nodes being removed from the network. These messages must come from a device that has already joined the network...

CVE-2026-89409 Unvalidated ZWAVE_CMD_NODES_EXIST May Cause Deletion of End Nodes​

In Z-Wave SDK 8.1.1 and earlier for 700/800 series devices and 6.85.02 and earlier for 500 series devices, missing checks in the ZWAVECMDNODESEXIST handler can result in nodes being removed from the network. These messages must come from a device that has already joined the network...

CVE-2026-89409

The Z-Wave SDK is vulnerable in versions 8.1.1 and earlier (for 700/800 series devices) and 6.85.02 and earlier (for 500 series devices) due to missing checks in the ZWAVE_CMD_NODES_EXIST handler. This flaw, categorized under CWE-940 , allows an attacker to cause the deletion of end nodes from th...

PT-2026-121397

In Z-Wave SDK 8.1.1 and earlier for 700/800 series devices and 6.85.02 and earlier for 500 series devices, missing checks in the ZWAVE CMD NODES EXIST handler can result in nodes being removed from the network. These messages must come from a device that has already joined the network...

Silicon Labs Z-Wave SDK authorization issue vulnerability

Silicon Labs Z-Wave SDK versions 8.1.1 and earlier for 700/800 series devices and 6.85.02 and earlier for 500 series devices contain an authorization issue vulnerability. This vulnerability stems from a lack of validation in the ZWAVECMDNODESEXIST handler, potentially allowing devices already on...

PT-2026-121398

Name of the Vulnerable Software and Affected Versions Z-Wave SDK versions prior to 8.1.2 Description A malformed NCP SPI command can trigger out-of-bounds reads, which may lead to the leakage of sensitive information. Out-of-bounds reads occur when a program reads data past the end of the intende...

Silicon Labs Z-Wave SDK buffer error vulnerability

Silicon Labs Z-Wave SDK versions 8.1.1 and earlier contain a buffer error vulnerability. This vulnerability arises because malformed NCP SPI commands can trigger an out-of-bounds read, potentially leading to the exposure of sensitive information...

CVE-2025-10933

An integer underflow vulnerability in the Silicon Labs Z-Wave Protocol Controller can lead to out of bounds memory reads...

CVE-2025-10933

An integer underflow vulnerability in the Silicon Labs Z-Wave Protocol Controller can lead to out of bounds memory reads...

CVE-2025-10933 Silicon Labs Z-Wave Protocol Controller Integer underflow vulnerability leads to out of bounds read

An integer underflow vulnerability in the Silicon Labs Z-Wave Protocol Controller can lead to out of bounds memory reads...

EUVD-2026-0838

An integer underflow vulnerability in the Silicon Labs Z-Wave Protocol Controller can lead to out of bounds memory reads...

CVE-2025-10933 Silicon Labs Z-Wave Protocol Controller Integer underflow vulnerability leads to out of bounds read

An integer underflow vulnerability in the Silicon Labs Z-Wave Protocol Controller can lead to out of bounds memory reads...