CVE-2026-49316
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In the Indian Motorcycle Scout Bobber + Tech (2025 model year), an expected behavior violation in the in-vehicle network allows an adjacent-network attacker to bypass the anti-theft shutdown by forcing the Wireless Control Module (WCM) into the CAN bus-off state. By injecting CAN error frames, the attacker causes the WCM to stop transmitting all messages, including the shutdown command. Other ECUs do not interpret WCM silence as a security event and continue normal operation, allowing the motorcycle to be operated without unlocking the immobilizer.
Risk Assessment
The risk is motorcycle theft or unauthorized use, as the immobilizer can be bypassed by an attacker within network range.
Recommendation
Contact the manufacturer (Indian Motorcycle) for a firmware update for the WCM that prevents bus-off state due to error frames.
Other vulnerabilities in Indian Motorcycle Scout Bobber + Tech
See all- CVE-2026-49325Medium
In the Indian Motorcycle Scout Bobber + Tech 2025 model, improper handling of physical conditions in the bike-shutdown control allows a physical attacker with access to the WCM wiring harness to bypass the anti-theft shutdown. The receiving ECU does not distinguish between an active shutdown pulse and an open-circuit condition; interrupting the relevant wires leaves the motorcycle fully operable even without PIN validation.
- CVE-2026-49324Medium
In the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025, uncontrolled resource consumption allows an adjacent attacker to permanently immobilize the motorcycle by sending a few crafted frames that trigger an immobilizer lockout without power-cycle reset.
- CVE-2026-49323Medium
Weak authentication between the Wireless Control Module (WCM) and Engine Control Module (ECM) in the 2025 Indian Motorcycle Scout Bobber + Tech allows an adjacent-network attacker to recover the ECM immobilizer secret by passively observing a single seed/key exchange. The attacker can then start the engine without the original key.
Original NVD description (English source)
Expected behavior violation in the in-vehicle network of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypass the motorcycle's anti-theft shutdown by forcing the Wireless Control Module (WCM) into the CAN bus-off state. Using a well-known CAN error-frame injection technique against a periodic WCM transmission, the attacker drives the WCM CAN controller's transmit error counter past the bus-off threshold, after which the WCM stops transmitting all messages, including the shutdown command. Peer ECUs do not interpret WCM silence as a security event and continue normal operation, allowing the motorcycle to be operated despite the immobilizer never having been unlocked. Specific protocol details have been withheld pending vendor remediation.