Scout Bobber + Tech CVE-2026-49323

Q: What is the CVSS score of CVE-2026-49323?

CVE-2026-49323 has a CVSS 4.0 base score of 4.1 (Medium). CVSS vector: CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33287 MEDIUM

Weak Authentication (CWE-1390)

2026-05-29 ASRG

GHSA-f65x-w4fq-xj28

Microsoft Information Disclosure Scout Bobber Tech

4.1

CVSS 4.0 · Vendor: ASRG

Severity by source

Vendor (ASRG) PRIMARY

4.1 MEDIUM

CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (ASRG) · only source for this CVE.

CVSS VectorVendor: ASRG

CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 13:22 vuln.today

CVSS changed

May 29, 2026 - 13:22 NVD

4.3 (MEDIUM) 4.1 (MEDIUM)

DescriptionCVE.org

Weak authentication between the Wireless Control Module (WCM) and the Engine Control Module (ECM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with read access to the in-vehicle network to recover the per-vehicle ECM immobilizer secret by passively observing a single seed/key exchange. The WCM derives its response using a reversible, non-cryptographic operation rather than a cryptographic challenge-response, so the persistent immobilizer secret can be reconstructed from one captured exchange. With this secret the attacker can authenticate to the ECM independently of the WCM and start the engine, defeating the immobilizer. Specific protocol details have been withheld pending vendor remediation.

AnalysisAI

Immobilizer bypass in the 2025 Indian Motorcycle Scout Bobber + Tech (Polaris Inc.) allows a physically adjacent attacker to permanently defeat the engine immobilizer by passively capturing a single WCM-to-ECM seed/key exchange. The Wireless Control Module derives its authentication response using a reversible, non-cryptographic operation, meaning the persistent per-vehicle ECM immobilizer secret can be mathematically reconstructed from one captured exchange - no brute force required. Once recovered, the secret enables independent ECM authentication and engine start without the physical key fob, nullifying the immobilizer entirely. No public exploit code has been identified at time of analysis, and no patch has been released; specific protocol details have been withheld by the researcher pending vendor remediation.

Technical ContextAI

The affected system is the authentication protocol between two in-vehicle modules on the 2025 Indian Motorcycle Scout Bobber + Tech, manufactured by Polaris Inc. (CPE: cpe:2.3:a:indian_motorcycle_(polaris_inc.):scout_bobber_+_tech:*:*:*:*:*:*:*:*). The Engine Control Module (ECM) implements a seed/key immobilizer - an industry-standard anti-theft mechanism where the ECM issues a random challenge (seed) and only starts if the key fob/WCM responds with the correct derived value (key). The vulnerability is classified under CWE-1390 (Weak Authentication), which covers cases where authentication mechanisms use insufficiently strong algorithms. Here, the WCM's key-derivation function is a reversible, non-cryptographic transformation of the seed rather than a one-way cryptographic function (e.g., HMAC-SHA256). This means an observer who captures both the seed and the response can algebraically invert the function to recover the persistent vehicle-specific secret stored in the ECM. The in-vehicle network protocol (likely a variant of CAN bus or a proprietary RF/Bluetooth channel given the 'adjacent-network' description) provides the passive capture surface. The secret is described as 'persistent' and 'per-vehicle,' indicating it is provisioned at manufacturing and never rotates, making a single successful capture a permanent compromise.

RemediationAI

No vendor-released patch has been identified at time of analysis; Polaris Inc. has been notified and specific protocol details are being withheld pending remediation. Until an ECU firmware update is released through an authorized Indian Motorcycle dealer, owners of the 2025 Scout Bobber + Tech should be aware of the following compensating controls and their trade-offs: First, avoid starting the motorcycle in environments where untrusted parties could have adjacent wireless access (e.g., crowded parking lots with unknown RF monitoring equipment), as exploitation requires passive capture of one legitimate key exchange - limiting exposure reduces capture opportunity. Second, physical security measures (disc locks, chain locks, ground anchors) remain effective because the vulnerability bypasses the immobilizer but does not address physical restraints; these add meaningful friction for a thief even after immobilizer defeat. Third, GPS tracking devices can provide recovery capability post-theft. Note that none of these compensating controls prevent the cryptographic secret from being captured and derived; they only raise the physical barrier to completing a theft. Owners should monitor Polaris/Indian Motorcycle service bulletins and dealer communications for an official ECM firmware update addressing this issue.