Scout Bobber Tech CVE-2026-49325

Exploitation requires direct, hands-on physical access to the 2025 Indian Motorcycle Scout Bobber + Tech's Wireless Control Module wiring harness - confirmed by CVSS AV:P. In practice this means the attacker must be able to remove or bypass body panels protecting the harness and then disconnect or cut the specific wire pair used by the WCM to signal shutdown to the peer ECU. The CVSS PR:N vector confirms no authentication credential or account access is needed once physical access is obtained. Limiting factors are significant: no remote, adjacent-network, or local software exploitation path exists; the attack is bounded to in-person access to the parked vehicle; and ASRG has withheld the specific connector identity pending vendor remediation, temporarily raising the technical knowledge bar. Non-default configuration, software settings, or network connectivity play no role in triggering this vulnerability.

The CVSS 4.6 (Medium) score is appropriate and principally deflated by AV:P (physical attack vector), which mandates hands-on access to the wiring harness - eliminating all remote and network-based exploitation paths. AC:L confirms the manipulation requires no specialized electronic skills once physical access is achieved, and PR:N reflects that no credentials are needed to execute the bypass. The A:H impact captures full defeat of the anti-theft immobilizer. No EPSS score was included in the provided intelligence, so probabilistic exploitation likelihood cannot be quantified. KEV status is not confirmed; no public proof-of-concept code has been identified at time of analysis. Real-world risk is bounded to targeted physical theft scenarios - a thief who can reach the harness. This is a meaningful risk for vehicle owners but not a mass-exploitation concern. The ASRG decision to withhold specific connector locations temporarily raises the bar for replication.

A thief approaches a parked 2025 Indian Motorcycle Scout Bobber + Tech, removes one or more body panels to expose the WCM wiring harness connector, and physically disconnects or cuts the dedicated shutdown signal wire pair - an action requiring basic hand tools and no electronic equipment. The receiving ECU, unable to distinguish this open-circuit condition from a valid operational state, releases the immobilizer and allows the engine to start and the motorcycle to be ridden away without any PIN entry. No public proof-of-concept code exists, but the attack requires only physical access and knowledge of the relevant connector location.