Scout Bobber + Tech CVE-2026-49324

Physical adjacency to the target motorcycle is required along with write access to the in-vehicle network bus, consistent with the CVSS:3.1 AV:P designation. The attacker must be able to connect a device capable of injecting frames onto the in-vehicle network, most practically via the OBD-II port or equivalent diagnostic interface on the 2025 Scout Bobber + Tech. No authentication to the WCM is required (CVSS PR:N) - the lockout counter increments on any qualifying unauthenticated message. The limiting factors are: (1) physical proximity to the specific vehicle, (2) ability to connect hardware to the in-vehicle bus, and (3) knowledge of a sufficient frame format to trigger the counter, with specific thresholds undisclosed by the reporter. Remote or network-based exploitation is not possible given AV:P. The vulnerability is specific to the 2025 model year Scout Bobber + Tech and not confirmed on other Indian Motorcycle models.

The CVSS 3.1 base score of 4.6 (Medium) reflects the physical access requirement encoded in the vector (AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The AV:P designation is critical context: while the attack requires no authentication (PR:N) and no user interaction (UI:N), it demands physical proximity to the vehicle and write-level access to its in-vehicle network bus, significantly constraining opportunistic mass exploitation. The sole impact is full Availability loss (A:H) - specifically permanent immobilization - with no confidentiality or integrity impact, which is consistent with the targeted nature of this vulnerability. No EPSS score was provided in the source data, and this CVE does not appear in the CISA KEV catalog, indicating no confirmed widespread active exploitation at time of analysis. No public proof-of-concept code has been identified. The real-world risk profile is best characterized as a targeted physical-access sabotage scenario - e.g., theft deterrence, fleet sabotage, or adversarial use against a specific individual's vehicle - rather than a remotely scalable attack. The CVSS Medium score is appropriate and not artificially deflated; the physical prerequisite is a genuine and substantial barrier. No conflicting signals between CVSS and description: both indicate physical proximity is required.

An attacker with physical proximity to the target motorcycle - for example, a valet, mechanic, or someone with brief unattended access - connects to the in-vehicle network via the OBD-II diagnostic port and transmits a small number of crafted unauthenticated frames targeting the WCM lockout counter. Because the counter increments on any qualifying unauthenticated message and does not reset on power cycle, the motorcycle's immobilizer enters a permanent lockout state after the threshold is crossed, rendering the vehicle un-startable until the owner transports it to a dealer for service. No public exploit code has been identified, but the attack requires only basic CAN bus tooling and knowledge of the frame format.