Zero Motorcycles Firmware CVE-2026-1354

Q: What is the CVSS score of CVE-2026-1354?

CVE-2026-1354 has a CVSS 4.0 base score of 5.9 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-24507 MEDIUM

Key Exchange without Entity Authentication (CWE-322)

2026-04-21 icscert

GHSA-7f6v-qrqr-m9gm

Information Disclosure Zero Motorcycles Firmware

5.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.4 MEDIUM

AV:A for Bluetooth proximity constraint; AC:H for multi-condition alignment (pairing mode, protocol knowledge, sustained proximity); UI:R because motorcycle must be actively placed in pairing mode; C:N as no data exfiltration is described.

3.1 AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

4.0 AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:31 vuln.today

CVSS changed

Apr 21, 2026 - 22:22 NVD

6.4 (MEDIUM) 5.9 (MEDIUM)

EUVD ID Assigned

Apr 21, 2026 - 22:16 euvd

EUVD-2026-24507

CVE Published

Apr 21, 2026 - 21:43 nvd

MEDIUM 5.9

DescriptionCVE.org

Zero Motorcycles firmware versions 44 and prior enable an attacker to forcibly pair a device with the motorcycle via Bluetooth. Once paired, an attacker can utilize over-the-air firmware updating functionality to potentially upload malicious firmware to the motorcycle. The motorcycle must first be in Bluetooth pairing mode, and the attacker must be in proximity of the vehicle and understand the full pairing process, to be able to pair their device with the vehicle. The attacker's device must remain paired with and in proximity of the motorcycle for the entire duration of the firmware update.

AnalysisAI

Forced Bluetooth pairing in Zero Motorcycles firmware versions 44 and prior enables an adjacent attacker to bypass device authentication and inject malicious over-the-air firmware updates onto affected motorcycles. Rooted in CWE-322 (Key Exchange without Entity Authentication), the flaw allows an unauthorized device to complete the pairing process without any credential verification, after which the attacker can abuse the legitimate OTA update channel to replace vehicle firmware with attacker-controlled code. No public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis, though the ICS-CERT advisory and physical-safety implications elevate the operational significance beyond the moderate CVSS 4.0 score of 5.9.

Technical ContextAI

The vulnerability resides in the Bluetooth pairing implementation within Zero Motorcycles firmware (CPE: cpe:2.3:a:zero_motorcycles:zero_motorcycles_firmware:*:*:*:*:*:*:*:*), affecting all versions up to and including version 44. CWE-322 describes a Key Exchange without Entity Authentication, meaning the pairing handshake does not cryptographically verify the identity of the requesting device, allowing any Bluetooth-capable device within range to successfully complete the pairing ceremony. Once paired, the attacker exploits the OTA firmware update mechanism - a legitimate channel intended for authorized updates - to push arbitrary firmware images. The attack leverages the Adjacent network vector (Bluetooth), meaning physical proximity to the motorcycle is a hard constraint. The ICS-CERT advisory (ICSA-26-111-06) classifies this as an Operational Technology (OT) vulnerability with potential physical safety consequences, distinguishing it from typical IT software flaws.

RemediationAI

The primary remediation is to upgrade Zero Motorcycles firmware to a version above 44 once the vendor releases a patched build - the ICS-CERT advisory should be consulted directly for the confirmed fix version, as no exact patched release number is independently verifiable from currently available references (https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-06). As an immediate compensating control, motorcycle owners and fleet operators should avoid placing vehicles in Bluetooth pairing mode in public or unsecured environments, since pairing mode is a hard prerequisite for exploitation. Pairing should only be initiated in controlled, trusted locations. Fleet operators managing multiple Zero Motorcycles units should audit currently paired devices and remove any unrecognized pairings through the vehicle interface. Until a patch is confirmed, restricting OTA firmware update initiation to physically secured, authorized service environments significantly reduces the attack surface, though this may impact legitimate update workflows.