Scout Bobber + Tech CVE-2026-49317

Q: What is the CVSS score of CVE-2026-49317?

CVE-2026-49317 has a CVSS 4.0 base score of 1.0 (Low). CVSS vector: CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33296 LOW

Incorrect Behavior Order (CWE-696)

2026-05-29 ASRG

GHSA-x7xq-w72j-v4qx

Authentication Bypass Scout Bobber Tech

1.0

CVSS 4.0 · Vendor: ASRG

Severity by source

Vendor (ASRG) PRIMARY

1.0 LOW

CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (ASRG) · only source for this CVE.

CVSS VectorVendor: ASRG

CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

May 29, 2026 - 14:22 NVD

2.4 (LOW) 1.0 (LOW)

Analysis Generated

May 29, 2026 - 14:21 vuln.today

DescriptionCVE.org

Incorrect behavior order in the Infotainment / Digital Round display of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypass the PIN entry screen. The Infotainment uses presence of Wireless Control Module (WCM) traffic during its boot window as a proxy for whether an immobilizer is fitted; if no WCM messages are observed, it skips the PIN entry screen and shows the normal user interface. An attacker who silences the WCM during the boot window - for example via a separately tracked CAN bus-off technique - can present a fully unlocked Infotainment despite the PIN never being entered. Specific timing and protocol details have been withheld pending vendor remediation.

AnalysisAI

PIN entry bypass in the Indian Motorcycle Scout Bobber + Tech 2025 infotainment system allows an attacker with physical proximity to the vehicle to access the fully unlocked infotainment interface without entering the correct PIN. The root cause (CWE-696, Incorrect Behavior Order) is that the system treats the presence of Wireless Control Module (WCM) CAN bus traffic during its startup boot window as a proxy for immobilizer detection, and skips PIN enforcement entirely when no WCM messages are observed - a condition an attacker can manufacture by silencing the WCM. Reported by ASRG with no public exploit code and no CISA KEV listing; specific timing and protocol details have been withheld pending vendor remediation.

Technical ContextAI

The affected component is the Infotainment / Digital Round display unit in the Indian Motorcycle Scout Bobber + Tech, 2025 model year, manufactured by Polaris Inc. (CPE: cpe:2.3:a:indian_motorcycle_(polaris_inc.):scout_bobber_+_tech:*:*:*:*:*:*:*:*). The infotainment and Wireless Control Module (WCM) communicate over the vehicle's CAN (Controller Area Network) bus, a broadcast protocol with no native sender authentication. CWE-696 (Incorrect Behavior Order) identifies the root cause: the authentication decision of whether to enforce PIN entry is evaluated based on an observable bus condition - WCM message presence - rather than on a positive, tamper-resistant attestation from the immobilizer subsystem. This inverts secure design principles, making PIN enforcement an opt-in outcome of untrusted bus state rather than a default that requires explicit bypass authorization. A CAN bus-off attack, a documented automotive technique that forces a node off the bus by inducing error conditions, is cited as one method to suppress WCM traffic.

RemediationAI

No vendor-released patch has been identified at time of analysis. ASRG has withheld specific timing and protocol details pending vendor remediation, indicating that coordinated disclosure with Indian Motorcycle (Polaris Inc.) is active but incomplete. Until a firmware update is released, owners relying on the infotainment PIN feature for vehicle security should avoid leaving the motorcycle unattended during the startup sequence in unsecured locations, as this is the window during which an attacker could interfere with CAN bus traffic - the trade-off is that this control is entirely behavioral and not enforceable. Owners should monitor Indian Motorcycle's official service bulletin and software update channels for remediation firmware. The CWE-696 root cause definition is available at https://cwe.mitre.org/data/definitions/696.html for technical context. If the vendor confirms that WCM silencing is achievable wirelessly at adjacent range, restricting physical proximity to the vehicle during startup would be an additional compensating control.