Scout Bobber + Tech CVE-2026-49317

Exploitation requires physical access to the motorcycle's CAN bus (e.g., via the OBD/diagnostic port or a direct bus tap) during a specific startup boot window - the duration and exact timing of this window have been withheld by ASRG pending vendor remediation. The PIN bypass is only meaningful if the vehicle owner has configured PIN protection on the infotainment system; vehicles without PIN protection enabled are not affected by this logic flaw. The CVSS AV:P vector confirms physical access as the baseline requirement, though the description's use of 'adjacent-network attacker' language introduces ambiguity about whether wireless WCM silencing at close range is feasible - this is unconfirmed and represents the key open question for risk assessment. Exploitation is scoped to the 2025 model year Scout Bobber + Tech; no other models are cited. The low CVSS confidentiality impact (C:L) indicates that what is exposed is the infotainment UI rather than high-sensitivity data or vehicle control systems.

The CVSS 3.1 base score of 2.4 (Low) reflects significant physical constraints: AV:P (Physical access required), AC:L (Low attack complexity), PR:N (no privileges required), UI:N (no user interaction needed), with impact limited to C:L (Low confidentiality) and no integrity or availability impact. A material discrepancy exists between the CVE description's characterization of an 'adjacent-network attacker' and the CVSS AV:P (Physical) designation - if WCM silencing is achievable wirelessly at adjacent range rather than requiring direct CAN bus access, the attack vector classification should be AV:A, which would meaningfully change exposure. This should be verified with ASRG or Indian Motorcycle before making access-vector-dependent risk decisions. No EPSS score was provided in the available data. The vulnerability is not listed in CISA KEV, and no public exploit code exists. Real-world risk is further constrained by the requirement to operate during a specific startup boot window, the limited scope to the 2025 model year, and the low confidentiality impact of exposing the infotainment UI. This is a low-priority finding for enterprise security teams but relevant for automotive security practitioners and vehicle owners concerned with unauthorized physical access scenarios.

An attacker with access to the motorcycle's CAN bus - obtained via the OBD diagnostic port or a direct bus tap - initiates a CAN bus-off attack targeting the Wireless Control Module during the infotainment's startup boot window, suppressing all WCM messages. The infotainment interprets the absence of WCM traffic as evidence that no immobilizer is fitted and skips the PIN entry screen, presenting the fully unlocked user interface. No public exploit code exists for this specific scenario, but CAN bus-off is a documented automotive security technique applicable to this attack path.