Skip to main content

Scout Bobber + Tech EUVDEUVD-2026-33257

| CVE-2026-49322 MEDIUM
Weak Authentication (CWE-1390)
2026-05-29 ASRG GHSA-cgpm-v8px-pmw8
Information Disclosure Microsoft Scout Bobber Tech
4.1
CVSS 4.0 · Vendor: ASRG
Share

Severity by source

Vendor (ASRG) PRIMARY
4.1 MEDIUM
CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (ASRG) · only source for this CVE.

CVSS VectorVendor: ASRG

CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Physical
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

2
CVSS changed
May 29, 2026 - 08:22 NVD
4.3 (MEDIUM) 4.1 (MEDIUM)
Analysis Generated
May 29, 2026 - 08:16 vuln.today

DescriptionCVE.org

Weak authentication in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with read access to the in-vehicle network to recover the user-set unlock PIN by passively observing a single PIN authentication exchange. The Infotainment Digital Round display computes its response using a non-cryptographic operation rather than a cryptographic challenge-response, so the PIN is mathematically derivable from one captured exchange, defeating the motorcycle's primary user-authentication control. Specific protocol details have been withheld pending vendor remediation.

AnalysisAI

The Wireless Control Module (WCM) in the 2025 Indian Motorcycle Scout Bobber + Tech exposes the user-set vehicle unlock PIN through a fatally weak authentication design in the Infotainment Digital Round display. The display's PIN verification relies on a non-cryptographic computation, meaning a passive observer who captures a single complete authentication exchange from the in-vehicle network can mathematically recover the exact PIN - no brute-force or active interaction required. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Gain proximity to target motorcycle
Delivery
Passively capture single PIN authentication exchange
Exploit
Derive PIN mathematically from captured exchange
Execution
Authenticate to WCM with recovered PIN
Impact
Unlock and access motorcycle
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to be within wireless range of the target 2025 Indian Motorcycle Scout Bobber + Tech - the description specifies 'adjacent-network' access (note: the CVSS vector assigns AV:P/Physical, which may understate reach; verify with vendor). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.3 (Medium) score reflects meaningful attack constraints: AV:P (Physical), AC:L, PR:N, UI:R, C:H/I:N/A:N. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker positions themselves within Bluetooth or in-vehicle wireless range of a parked 2025 Scout Bobber + Tech and runs a passive radio capture tool. When the legitimate owner authenticates with their PIN on the Infotainment Digital Round display - for example, to unlock the motorcycle after a stop - the attacker's tool records the single authentication exchange. …
Remediation No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Scout Bobber Tech

View all
CVE-2026-49316 MEDIUM
4.1 May 29

CAN bus error-frame injection on the 2025 Indian Motorcycle Scout Bobber + Tech defeats the Wireless Control Module (WCM
CVE-2026-49325 MEDIUM
4.1 May 29

Anti-theft bypass in the 2025 Indian Motorcycle Scout Bobber + Tech allows a physical attacker who can access the Wirele
CVE-2026-49324 MEDIUM
4.1 May 29

Permanent denial-of-service against the 2025 Indian Motorcycle Scout Bobber + Tech's Wireless Control Module (WCM) allow
CVE-2026-49323 MEDIUM
4.1 May 29

Immobilizer bypass in the 2025 Indian Motorcycle Scout Bobber + Tech (Polaris Inc.) allows a physically adjacent attacke
CVE-2026-49318 LOW
1.0 May 29

PIN screen authentication bypass in the 2025 Indian Motorcycle Scout Bobber + Tech Infotainment / Digital Round display

CVE-2026-49317 LOW
1.0 May 29

PIN entry bypass in the Indian Motorcycle Scout Bobber + Tech 2025 infotainment system allows an attacker with physical

Same weakness CWE-1390 – Weak Authentication

View all
CVE-2025-40552 CRITICAL POC
9.8
CVE-2025-40554 CRITICAL POC
9.8
CVE-2025-24070 HIGH POC
7.0
CVE-2025-30412 CRITICAL
10.0
CVE-2025-30411 CRITICAL
10.0
CVE-2025-1387 CRITICAL
9.8
CVE-2025-39596 CRITICAL
9.8
CVE-2026-28710 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2014-6324 HIGH POC
8.8
CVE-2017-0213 HIGH POC
7.3
CVE-2016-7255 HIGH POC
7.8
CVE-2010-0232 HIGH POC
7.8
CVE-2025-30066 HIGH POC
8.6
CVE-2025-54236 CRITICAL POC
9.1

Share

EUVD-2026-33257 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy