CVE-2026-49323
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Weak authentication between the Wireless Control Module (WCM) and Engine Control Module (ECM) in the 2025 Indian Motorcycle Scout Bobber + Tech allows an adjacent-network attacker to recover the ECM immobilizer secret by passively observing a single seed/key exchange. The attacker can then start the engine without the original key.
Risk Assessment
The risk is that an attacker within vehicle network range can steal the motorcycle by reconstructing the immobilizer secret and starting the engine without the physical key.
Recommendation
Contact the manufacturer for a firmware update that replaces the reversible cryptographic operation with a proper challenge-response mechanism.
Other vulnerabilities in Indian Motorcycle Scout Bobber + Tech
See all- CVE-2026-49325Medium
In the Indian Motorcycle Scout Bobber + Tech 2025 model, improper handling of physical conditions in the bike-shutdown control allows a physical attacker with access to the WCM wiring harness to bypass the anti-theft shutdown. The receiving ECU does not distinguish between an active shutdown pulse and an open-circuit condition; interrupting the relevant wires leaves the motorcycle fully operable even without PIN validation.
- CVE-2026-49316Medium
In the Indian Motorcycle Scout Bobber + Tech (2025 model year), an expected behavior violation in the in-vehicle network allows an adjacent-network attacker to bypass the anti-theft shutdown by forcing the Wireless Control Module (WCM) into the CAN bus-off state. By injecting CAN error frames, the attacker causes the WCM to stop transmitting all messages, including the shutdown command. Other ECUs do not interpret WCM silence as a security event and continue normal operation, allowing the motorcycle to be operated without unlocking the immobilizer.
- CVE-2026-49324Medium
In the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025, uncontrolled resource consumption allows an adjacent attacker to permanently immobilize the motorcycle by sending a few crafted frames that trigger an immobilizer lockout without power-cycle reset.
Original NVD description (English source)
Weak authentication between the Wireless Control Module (WCM) and the Engine Control Module (ECM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with read access to the in-vehicle network to recover the per-vehicle ECM immobilizer secret by passively observing a single seed/key exchange. The WCM derives its response using a reversible, non-cryptographic operation rather than a cryptographic challenge-response, so the persistent immobilizer secret can be reconstructed from one captured exchange. With this secret the attacker can authenticate to the ECM independently of the WCM and start the engine, defeating the immobilizer. Specific protocol details have been withheld pending vendor remediation.