Scout Bobber + Tech EUVD-2026-33257

Q: What is the CVSS score of EUVD-2026-33257?

EUVD-2026-33257 has a CVSS 4.0 base score of 4.1 (Medium). CVSS vector: CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-49322 MEDIUM

Weak Authentication (CWE-1390)

2026-05-29 ASRG

GHSA-cgpm-v8px-pmw8

Microsoft Information Disclosure Scout Bobber Tech

4.1

CVSS 4.0 · Vendor: ASRG

Severity by source

Vendor (ASRG) PRIMARY

4.1 MEDIUM

CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (ASRG) · only source for this CVE.

CVSS VectorVendor: ASRG

CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

CVSS changed

May 29, 2026 - 08:22 NVD

4.3 (MEDIUM) 4.1 (MEDIUM)

Analysis Generated

May 29, 2026 - 08:16 vuln.today

DescriptionCVE.org

Weak authentication in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with read access to the in-vehicle network to recover the user-set unlock PIN by passively observing a single PIN authentication exchange. The Infotainment Digital Round display computes its response using a non-cryptographic operation rather than a cryptographic challenge-response, so the PIN is mathematically derivable from one captured exchange, defeating the motorcycle's primary user-authentication control. Specific protocol details have been withheld pending vendor remediation.

AnalysisAI

The Wireless Control Module (WCM) in the 2025 Indian Motorcycle Scout Bobber + Tech exposes the user-set vehicle unlock PIN through a fatally weak authentication design in the Infotainment Digital Round display. The display's PIN verification relies on a non-cryptographic computation, meaning a passive observer who captures a single complete authentication exchange from the in-vehicle network can mathematically recover the exact PIN - no brute-force or active interaction required. Reported by ASRG against a product manufactured by Polaris Inc., this vulnerability defeats the motorcycle's primary user-authentication control; it is not listed in CISA KEV and no public exploit code has been identified at time of analysis.

Technical ContextAI

The root cause is CWE-1390 (Weak Authentication), which describes authentication mechanisms that are insufficiently strong to prevent credential recovery or reverse engineering. In this case, the Infotainment Digital Round display in the WCM computes its PIN authentication response using a non-cryptographic operation, making the mathematical relationship between the PIN and the observed network exchange deterministic and reversible from a single capture. A cryptographically secure challenge-response protocol (e.g., HMAC or asymmetric challenge) would produce unpredictable outputs that reveal nothing about the secret even across many observed exchanges - the absence of such a design is the core defect. The affected product is identified by CPE string cpe:2.3:a:indian_motorcycle_(polaris_inc.):scout_bobber_+_tech:*:*:*:*:*:*:*:* (Polaris Inc. manufacturer). The in-vehicle communication medium is consistent with automotive wireless channels (e.g., Bluetooth/BLE via the WCM), which are observable by an adjacent attacker without physical wire access. Specific protocol details have been withheld by ASRG pending vendor remediation.

RemediationAI

No vendor-released patch has been identified at time of analysis. The CVE description explicitly states protocol specifics are withheld pending vendor remediation, confirming Polaris Inc. and Indian Motorcycle have been notified by ASRG but have not yet released a firmware fix. Owners should monitor Indian Motorcycle and Polaris Inc. official security channels for a firmware update replacing the non-cryptographic PIN authentication mechanism with a cryptographically sound challenge-response design. As a compensating control, users should avoid performing PIN authentication exchanges in public or high-risk environments (e.g., crowded parking areas, locations with untrusted Bluetooth proximity), since the attack requires UI:R - a live authentication event - to capture the exchange; no event means no capture. Rotating the PIN periodically reduces the utility of a previously captured exchange but does not eliminate the vulnerability, as any new exchange is equally exploitable. No vendor advisory URL is currently available.