Scout Bobber + Tech CVE-2026-49322

Exploitation requires the attacker to be within wireless range of the target 2025 Indian Motorcycle Scout Bobber + Tech - the description specifies 'adjacent-network' access (note: the CVSS vector assigns AV:P/Physical, which may understate reach; verify with vendor). The victim must actively perform a PIN authentication exchange on the Infotainment Digital Round display during the observation window - this is the UI:R constraint, meaning exploitation cannot proceed without a live authentication event. The PIN authentication feature must be configured and in active use on the vehicle. No attacker privileges are required (PR:N). Exploitation is bounded to confidentiality only (PIN recovery); no integrity or availability impact is introduced by this vulnerability alone. The limiting factors are: (1) proximity to the vehicle, (2) dependency on the victim initiating a PIN exchange, and (3) the 2025 model year and Scout Bobber + Tech trim specifically - no other models are confirmed affected.

The CVSS 4.3 (Medium) score reflects meaningful attack constraints: AV:P (Physical), AC:L, PR:N, UI:R, C:H/I:N/A:N. However, a material discrepancy exists - the description characterizes the attacker as requiring 'adjacent-network' access, which in CVSS 3.1 maps to AV:A (Adjacent), not AV:P (Physical). If the actual attack surface is truly adjacent-network (e.g., Bluetooth range), the base score would increase and the attack surface is broader than the current vector suggests; this should be confirmed with the vendor or ASRG. The C:H rating is significant in context: the compromised asset is the vehicle's unlock PIN, the sole user-authentication control for the motorcycle - recovery of this PIN enables physical vehicle access. The UI:R constraint (victim must actively perform a PIN exchange during the observation window) meaningfully limits opportunistic mass exploitation but does not protect against targeted theft scenarios where an attacker can linger near the vehicle. No EPSS data was provided. The vulnerability is not in CISA KEV and no public exploit code has been identified, suggesting it has not been weaponized at scale. Real-world risk is low for opportunistic attacks but moderate-to-high for targeted vehicle theft scenarios.

An attacker positions themselves within Bluetooth or in-vehicle wireless range of a parked 2025 Scout Bobber + Tech and runs a passive radio capture tool. When the legitimate owner authenticates with their PIN on the Infotainment Digital Round display - for example, to unlock the motorcycle after a stop - the attacker's tool records the single authentication exchange. The attacker then applies the mathematical derivation (algorithm withheld pending remediation) off-line to recover the exact PIN, subsequently authenticating to the WCM to unlock the motorcycle. No public exploit code has been identified at time of analysis.