Scout Bobber + Tech CVE-2026-49318

Exploitation requires physical or near-physical access to the vehicle's CAN bus network, most practically via the OBD-II diagnostic port, to execute a CAN bus-off fault injection attack against the Wireless Control Module. The WCM must be silenced specifically during the infotainment's boot window - timing precision is required, and the attack cannot be performed post-boot against an already-running infotainment session. The vulnerability is limited to 2025 model year Indian Scout Bobber + Tech units that are equipped with both the PIN-protected Infotainment / Digital Round display and a WCM. The attack depends on a second, separately characterized CAN bus-off technique, meaning successful exploitation is not a single-step action. The confidentiality impact is bounded to infotainment UI access - the vehicle's drivetrain immobilizer is not bypassed by this vulnerability alone, limiting the practical consequence for vehicle theft scenarios. Authentication requirements per CVSS PR:N indicate no prior credentials are required, but physical access to the CAN bus is the binding prerequisite.

The CVSS 3.1 score of 2.4 (Low) accurately reflects the genuine real-world risk ceiling. The attack vector is scored Physical (AV:P), which requires the attacker to have hands-on access to the vehicle's CAN bus - typically via the OBD-II port or interior wiring. However, there is a notable discrepancy worth flagging: the vulnerability description characterizes the required attacker position as 'adjacent-network,' while the CVSS vector assigns AV:P (Physical); defenders should verify with ASRG or the vendor which more accurately scopes the exploitable attack surface. Attack complexity is scored Low (AC:L), though this appears to understate real-world difficulty - the attack requires orchestrating a separate CAN bus-off technique with precise boot-window timing, which adds meaningful operational complexity not captured by AC:L. Impact is Confidentiality: Low only (C:L, I:N, A:N), meaning an attacker who succeeds gains access to the infotainment UI without a PIN but does not gain write access to vehicle systems and does not affect the drivetrain immobilizer through this vulnerability alone. No EPSS data was provided, no CISA KEV listing exists, and no public exploit or proof-of-concept has been identified. Overall: low priority for most defenders, but non-trivial for vehicle security teams given the authentication bypass nature and physical access preconditions.

An attacker with physical access to a parked 2025 Scout Bobber + Tech connects a commodity CAN bus interface (e.g., USB-CAN adapter) to the OBD-II port and transmits a CAN bus-off fault sequence targeting the Wireless Control Module before the rider powers on the infotainment. When the rider initiates boot, the infotainment observes no WCM traffic during its detection window, concludes no immobilizer is present, and bypasses the PIN screen - presenting the full unlocked infotainment UI. No public exploit code has been identified at time of analysis, but the required tooling (CAN bus interfaces, bus-off scripts) is widely available in automotive security research communities.