The vulnerability resides in the ZWAVE_CMD_NODES_EXIST handler of the Silicon Labs Z‑Wave SDK. Because the handler does not validate that a request comes from a device that has already joined the network, an attacker can trigger the removal of end nodes from the network. If an end node is removed, the device can no longer communicate, causing a loss of functionality. This weakness is a CWE‑940 vulnerability that permits unauthorized deletion of nodes.

Devices using Silicon Labs Z‑Wave SDK 8.1.1 or earlier for 700/800 series, and 6.85.02 or earlier for 500 series are affected. The vulnerability applies to any device that runs these firmware versions and participates in a Z‑Wave network.

The CVSS score of 5.3 indicates a moderate risk. Because no EPSS score is available and the issue is not listed in the CISA KEV catalog, the likelihood of widespread exploitation remains uncertain; however, an attacker who can inject a ZWAVE_CMD_NODES_EXIST command from a local device that has joined the network could remove nodes. The vulnerability requires local network access and an attacker must control or impersonate a device, providing no remote code execution or privilege escalation. The attack scope is limited to the affected Z‑Wave network.