Scout Bobber + Tech CVE-2026-49323

Exploitation requires the attacker to be in adjacent wireless range of the target motorcycle at the moment the owner performs a legitimate engine-start key exchange (UI:R) - the attacker cannot trigger this exchange themselves. Read access to the in-vehicle network (the WCM-ECM communication channel) is required to passively capture the seed and derived response. The vulnerability is inherent to the non-cryptographic design of the WCM key-derivation function and is therefore present in all 2025 Scout Bobber + Tech units regardless of configuration; no non-default setting is required to be vulnerable. Exploitation is limited by: (1) physical/RF proximity at time of capture - AV:P per CVSS, though adjacent wireless range may be more accurate pending clarification; (2) the requirement for the legitimate owner to perform one key exchange while the attacker is monitoring (UI:R); (3) the attacker must implement or possess the specific reversal algorithm for the undisclosed protocol - technical details are currently withheld, raising the bar for independent rediscovery. Authentication to the ECM using the recovered secret requires no special privileges (PR:N).

Despite a CVSS 3.1 base score of 4.3 (Medium), the real-world risk to vehicle owners is materially higher than the score suggests in the context of vehicle theft. The CVSS vector (AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms physical proximity is required (AV:P), attack complexity is low once in range (AC:L), no authentication privileges are needed (PR:N), and user interaction is required (UI:R) - meaning the attacker must be present during a legitimate key exchange (i.e., the owner starting the motorcycle). The C:H impact reflects full recovery of the immobilizer secret. The I:N and A:N scores are technically correct from a CVSS perspective, but the practical integrity impact - ability to start and steal the vehicle - is severe and not captured by the scoring. There is a minor framing tension: the description uses 'adjacent-network attacker with read access to the in-vehicle network' which implies short-range wireless (Bluetooth, RF), while CVSS AV:P implies physical touch-distance; this discrepancy should be verified with the reporter (ASRG) or vendor, as AV:A (Adjacent Network) may more accurately characterize RF-range passive interception. No EPSS score was provided. No KEV listing exists. No public exploit code has been identified at time of analysis. The absence of a patch and the disclosure by ASRG pending vendor remediation suggest this is in coordinated disclosure phase - exploitation risk will increase if technical details are fully published before a fix is available.

An attacker parks near a 2025 Indian Scout Bobber + Tech with a software-defined radio or equivalent in-vehicle network sniffer capable of passively recording the WCM-ECM authentication exchange. When the legitimate owner starts the motorcycle, the attacker captures the single seed/key pair. Offline, the attacker inverts the reversible non-cryptographic derivation function to recover the persistent per-vehicle immobilizer secret. On a subsequent occasion - potentially hours or days later - the attacker approaches the unattended motorcycle, replays or derives the correct key response to the ECM independently of the physical key fob, and starts the engine to steal the vehicle. No public exploit code has been identified at time of analysis, though the mathematical reversal is described as feasible from a single observation.