Indian Motorcycle Scout Bobber + Tech vulnerabilities

In the Indian Motorcycle Scout Bobber + Tech 2025 model, improper handling of physical conditions in the bike-shutdown control allows a physical attacker with access to the WCM wiring harness to bypass the anti-theft shutdown. The receiving ECU does not distinguish between an active shutdown pulse and an open-circuit condition; interrupting the relevant wires leaves the motorcycle fully operable even without PIN validation.

In the Indian Motorcycle Scout Bobber + Tech (2025 model year), an expected behavior violation in the in-vehicle network allows an adjacent-network attacker to bypass the anti-theft shutdown by forcing the Wireless Control Module (WCM) into the CAN bus-off state. By injecting CAN error frames, the attacker causes the WCM to stop transmitting all messages, including the shutdown command. Other ECUs do not interpret WCM silence as a security event and continue normal operation, allowing the motorcycle to be operated without unlocking the immobilizer.

In the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025, uncontrolled resource consumption allows an adjacent attacker to permanently immobilize the motorcycle by sending a few crafted frames that trigger an immobilizer lockout without power-cycle reset.

Weak authentication between the Wireless Control Module (WCM) and Engine Control Module (ECM) in the 2025 Indian Motorcycle Scout Bobber + Tech allows an adjacent-network attacker to recover the ECM immobilizer secret by passively observing a single seed/key exchange. The attacker can then start the engine without the original key.