Scout Bobber Tech CVE-2026-49316

Q: What is the CVSS score of CVE-2026-49316?

CVE-2026-49316 has a CVSS 4.0 base score of 4.1 (Medium). CVSS vector: CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33293 MEDIUM

Expected Behavior Violation (CWE-440)

2026-05-29 ASRG

GHSA-xpm6-xp6j-7w29

Authentication Bypass Scout Bobber Tech

4.1

CVSS 4.0 · Vendor: ASRG

Severity by source

Vendor (ASRG) PRIMARY

4.1 MEDIUM

CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (ASRG) · only source for this CVE.

CVSS VectorVendor: ASRG

CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 14:32 vuln.today

CVSS changed

May 29, 2026 - 14:22 NVD

4.6 (MEDIUM) 4.1 (MEDIUM)

DescriptionCVE.org

Expected behavior violation in the in-vehicle network of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypass the motorcycle's anti-theft shutdown by forcing the Wireless Control Module (WCM) into the CAN bus-off state. Using a well-known CAN error-frame injection technique against a periodic WCM transmission, the attacker drives the WCM CAN controller's transmit error counter past the bus-off threshold, after which the WCM stops transmitting all messages, including the shutdown command. Peer ECUs do not interpret WCM silence as a security event and continue normal operation, allowing the motorcycle to be operated despite the immobilizer never having been unlocked. Specific protocol details have been withheld pending vendor remediation.

AnalysisAI

CAN bus error-frame injection on the 2025 Indian Motorcycle Scout Bobber + Tech defeats the Wireless Control Module (WCM)-enforced immobilizer, enabling vehicle operation without legitimate anti-theft deactivation. An attacker within physical or adjacent proximity drives the WCM's CAN controller into bus-off state by incrementing its transmit error counter past the threshold, permanently silencing the WCM's periodic shutdown command. Because peer ECUs treat WCM silence as benign rather than a security event - a fail-open design - the motorcycle becomes fully operable as though the immobilizer were properly unlocked. No public exploit code has been identified at time of analysis; ASRG is withholding full protocol details pending vendor remediation, reported under CVE-2026-49316.

Technical ContextAI

The 2025 Indian Motorcycle Scout Bobber + Tech (Polaris Inc.) uses a Controller Area Network (CAN) bus for intra-vehicle ECU communication per ISO 11898. The Wireless Control Module (WCM) is the anti-theft enforcement node, periodically broadcasting an immobilizer-state message that keeps the shutdown engaged unless a legitimately authenticated key-fob transaction releases it. CAN is a multi-master bus with no native message authentication; its error confinement mechanism is engineered for fault tolerance, not adversarial resilience. ISO 11898 error confinement defines a transmit error counter (TEC) that increments on detected transmission faults; at TEC=255 the node enters bus-off state and ceases all CAN activity. CWE-440 (Expected Behavior Violation) is the root cause: the WCM's bus-off silence is an expected hardware behavior from a fault-tolerance perspective, but the peer ECUs violate the security expectation by not treating that silence as an immobilizer-relevant event - producing a fail-open outcome. CPE cpe:2.3:a:indian_motorcycle_(polaris_inc.):scout_bobber_+_tech:*:*:*:*:*:*:*:* with a wildcard version segment indicates all known firmware revisions of the 2025 model year are in scope.

RemediationAI

No vendor-released patch has been identified at time of analysis. ASRG has disclosed the vulnerability under coordinated conditions and is withholding full technical protocol details pending remediation by Indian Motorcycle / Polaris Inc.; owners and fleet operators should monitor Polaris Inc. official security channels for a WCM firmware update that redefines bus-off handling - the durable fix requires peer ECUs to treat WCM silence as a security-relevant event and assert an independent immobilizer lockout. Until a firmware update is available, the following specific compensating controls reduce risk with noted trade-offs: physically securing the OBD-II port (aftermarket port locks, tamper-evident covers) raises the bar for wired CAN injection - trade-off: does not address a wireless CAN injection path if the attacker exploits the WCM wireless interface. Storing the motorcycle in a locked, monitored enclosure limits attacker dwell time required to complete the error-counter increment sequence - trade-off: logistically impractical for daily riders. Installing an aftermarket GPS tracker provides theft detection rather than prevention, enabling rapid recovery - trade-off: does not prevent the bypass. None of these measures address the fail-open WCM silence design; only an OEM-supplied firmware update constitutes a structural fix.