Skip to main content

Scout Bobber Tech CVE-2026-49325

| EUVDEUVD-2026-33292 MEDIUM
Improper Handling of Physical or Environmental Conditions (CWE-1384)
2026-05-29 ASRG GHSA-c9x8-xp9p-g29g
Authentication Bypass Scout Bobber Tech
4.1
CVSS 4.0 · Vendor: ASRG
Share

Severity by source

Vendor (ASRG) PRIMARY
4.1 MEDIUM
CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (ASRG) · only source for this CVE.

CVSS VectorVendor: ASRG

CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Physical
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
CVSS changed
May 29, 2026 - 14:22 NVD
4.6 (MEDIUM) 4.1 (MEDIUM)
Analysis Generated
May 29, 2026 - 14:21 vuln.today

DescriptionCVE.org

Improper handling of physical conditions in the bike-shutdown control of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows a physical attacker with access to the Wireless Control Module (WCM) wiring harness to bypass the anti-theft shutdown. The WCM signals shutdown to a peer ECU via a falling-edge voltage transition on a dedicated wire pair. The receiving ECU does not distinguish between an active shutdown pulse and an open-circuit / disconnected condition; interrupting the relevant wires leaves the motorcycle fully operable even though the WCM never validated the rider's PIN. Specific connector details have been withheld pending vendor remediation.

AnalysisAI

Anti-theft bypass in the 2025 Indian Motorcycle Scout Bobber + Tech allows a physical attacker who can access the Wireless Control Module wiring harness to leave the motorcycle fully operable without ever supplying a valid rider PIN. The root flaw is a fail-open ECU design: the peer ECU cannot distinguish an authenticated WCM shutdown pulse from a simple open-circuit condition caused by disconnecting the relevant wire pair, so wire interruption silently suppresses the immobilizer. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Gain physical access to motorcycle
Delivery
Remove body panels to expose WCM harness
Exploit
Disconnect or cut shutdown signal wire pair
Execution
ECU defaults to operational state
Impact
Start and ride motorcycle without PIN
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires direct, hands-on physical access to the 2025 Indian Motorcycle Scout Bobber + Tech's Wireless Control Module wiring harness - confirmed by CVSS AV:P. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.6 (Medium) score is appropriate and principally deflated by AV:P (physical attack vector), which mandates hands-on access to the wiring harness - eliminating all remote and network-based exploitation paths. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A thief approaches a parked 2025 Indian Motorcycle Scout Bobber + Tech, removes one or more body panels to expose the WCM wiring harness connector, and physically disconnects or cuts the dedicated shutdown signal wire pair - an action requiring basic hand tools and no electronic equipment. The receiving ECU, unable to distinguish this open-circuit condition from a valid operational state, releases the immobilizer and allows the engine to start and the motorcycle to be ridden away without any PIN entry. …
Remediation No vendor-released patch has been identified at time of analysis; Polaris Inc. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Scout Bobber Tech

View all
CVE-2026-49316 MEDIUM
4.1 May 29

CAN bus error-frame injection on the 2025 Indian Motorcycle Scout Bobber + Tech defeats the Wireless Control Module (WCM
CVE-2026-49324 MEDIUM
4.1 May 29

Permanent denial-of-service against the 2025 Indian Motorcycle Scout Bobber + Tech's Wireless Control Module (WCM) allow
CVE-2026-49323 MEDIUM
4.1 May 29

Immobilizer bypass in the 2025 Indian Motorcycle Scout Bobber + Tech (Polaris Inc.) allows a physically adjacent attacke
CVE-2026-49322 MEDIUM
4.1 May 29

The Wireless Control Module (WCM) in the 2025 Indian Motorcycle Scout Bobber + Tech exposes the user-set vehicle unlock

CVE-2026-49318 LOW
1.0 May 29

PIN screen authentication bypass in the 2025 Indian Motorcycle Scout Bobber + Tech Infotainment / Digital Round display

CVE-2026-49317 LOW
1.0 May 29

PIN entry bypass in the Indian Motorcycle Scout Bobber + Tech 2025 infotainment system allows an attacker with physical

Same weakness CWE-1384 – Improper Handling of Physical or Environmental Conditions

View all
CVE-2026-2760 CRITICAL
10.0
CVE-2026-2759 CRITICAL
9.8
CVE-2026-2757 CRITICAL
9.8
CVE-2025-52557 HIGH
8.6
CVE-2024-39355 MEDIUM
5.7

Same technique Authentication Bypass

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2025-3248 CRITICAL POC
9.8
CVE-2025-49113 CRITICAL POC
9.9
CVE-2020-5849 HIGH POC
7.5
CVE-2024-7593 CRITICAL POC
9.8

Share

CVE-2026-49325 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy