CVE-2026-49325
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In the Indian Motorcycle Scout Bobber + Tech 2025 model, improper handling of physical conditions in the bike-shutdown control allows a physical attacker with access to the WCM wiring harness to bypass the anti-theft shutdown. The receiving ECU does not distinguish between an active shutdown pulse and an open-circuit condition; interrupting the relevant wires leaves the motorcycle fully operable even without PIN validation.
Risk Assessment
A physical attacker can steal the motorcycle without knowing the PIN, posing a serious risk to vehicle owners.
Recommendation
Contact the manufacturer for patches or apply additional physical security measures.
Other vulnerabilities in Indian Motorcycle Scout Bobber + Tech
See all- CVE-2026-49316Medium
In the Indian Motorcycle Scout Bobber + Tech (2025 model year), an expected behavior violation in the in-vehicle network allows an adjacent-network attacker to bypass the anti-theft shutdown by forcing the Wireless Control Module (WCM) into the CAN bus-off state. By injecting CAN error frames, the attacker causes the WCM to stop transmitting all messages, including the shutdown command. Other ECUs do not interpret WCM silence as a security event and continue normal operation, allowing the motorcycle to be operated without unlocking the immobilizer.
- CVE-2026-49324Medium
In the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025, uncontrolled resource consumption allows an adjacent attacker to permanently immobilize the motorcycle by sending a few crafted frames that trigger an immobilizer lockout without power-cycle reset.
- CVE-2026-49323Medium
Weak authentication between the Wireless Control Module (WCM) and Engine Control Module (ECM) in the 2025 Indian Motorcycle Scout Bobber + Tech allows an adjacent-network attacker to recover the ECM immobilizer secret by passively observing a single seed/key exchange. The attacker can then start the engine without the original key.
Original NVD description (English source)
Improper handling of physical conditions in the bike-shutdown control of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows a physical attacker with access to the Wireless Control Module (WCM) wiring harness to bypass the anti-theft shutdown. The WCM signals shutdown to a peer ECU via a falling-edge voltage transition on a dedicated wire pair. The receiving ECU does not distinguish between an active shutdown pulse and an open-circuit / disconnected condition; interrupting the relevant wires leaves the motorcycle fully operable even though the WCM never validated the rider's PIN. Specific connector details have been withheld pending vendor remediation.