Zero Motorcycles Firmware CVE-2026-1354

Exploitation requires the motorcycle to be actively placed in Bluetooth pairing mode - this is a non-default state that must be explicitly initiated by the rider or technician, and it represents the single most significant limiting condition. The attacker must be within Bluetooth range (typically under 10 meters) for both the pairing phase and the entire duration of the subsequent firmware update. The attacker must also possess knowledge of the complete Zero Motorcycles Bluetooth pairing process, adding a reconnaissance prerequisite. No authentication credentials are required once pairing mode is active, per CVSS PR:N. CVSS AT:P (Attack Targeted: Present) confirms that specific preconditions - pairing mode active, attacker in proximity, attacker understanding of protocol - must all align simultaneously. What limits exploitation: (1) pairing mode is not a default idle state; (2) physical proximity is mandatory and sustained throughout update; (3) Bluetooth range constrains the attack to adjacent physical environments; (4) SSVC rates automatable as 'no', ruling out scalable or remote mass exploitation.

Multiple intelligence signals converge on a moderate but operationally significant risk profile. The CVSS 4.0 score of 5.9 reflects the High attack complexity (AC:H) and passive user interaction requirement (UI:P), both of which materially constrain exploitability. EPSS confirms this: a 0.02% probability (6th percentile) indicates near-zero opportunistic exploitation in typical IT environments. CISA SSVC corroborates this - Exploitation: none, Automatable: no, Technical Impact: partial. However, the affected product is a motor vehicle, and the integrity and availability impacts (VI:H/VA:H in CVSS 4.0) carry physical safety implications that CVSS numeric scores underweight. An attacker delivering malicious firmware could potentially affect braking, throttle, or battery management systems depending on the firmware's scope. The 'Information Disclosure' tag in the source intelligence appears inconsistent with the CVSS vector (VC:N) and description, which focus entirely on firmware injection rather than data exfiltration - this is likely a tagging error and should not be treated as confirmed. The non-default pairing-mode requirement and mandatory sustained proximity throughout the entire update process are meaningful friction points that prevent mass exploitation. This is a targeted, proximity-constrained, low-automation-potential attack - the primary concern is a motivated actor with physical access opportunity (e.g., a parking lot or service scenario).

An attacker targeting a specific Zero Motorcycle parks adjacent to the vehicle in a public location while the owner initiates Bluetooth pairing to connect an accessory. The attacker's device detects the pairing broadcast, completes the unauthenticated pairing handshake, and presents itself as a legitimate update server to push a modified firmware image containing altered throttle or battery management code. The attacker must maintain Bluetooth proximity - typically within 10 meters - for the full duration of the firmware flashing process, which constrains the scenario to opportunistic or staged physical-access situations. No public proof-of-concept code has been identified at time of analysis.