Live › vulnerability › CVE-2026-89410
Go to dashboardIn Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command triggers out-of-bounds reads. An attacker can leak sensitive information from device memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Devices or firmware built on Z-Wave SDK 8.1.1 or earlier that accept NCP SPI commands. The sources do not list specific products or whether network-facing paths are involved, so unknown beyond the SDK version.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigger out-of-bounds reads that leak sensitive information.
This page as .md · .json · in your agent: get_signal("CVE-2026-89410")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.