EUVD-2026-33289
GHSA-6x8x-4qf6-w7qg
Severity by source
CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (ASRG) · only source for this CVE.
CVSS VectorVendor: ASRG
CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Uncontrolled resource consumption in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with write access to the in-vehicle network to permanently immobilize the motorcycle. The WCM enforces a brute-force lockout on the immobilizer authentication algorithm, but the lockout counter is reachable by any unauthenticated message, has no session binding, and does not reset on power cycle. An attacker can deliberately trip the lockout with a small number of crafted frames, leaving the bike un-startable until dealer service. Specific thresholds have been withheld pending vendor remediation.
AnalysisAI
Permanent denial-of-service against the 2025 Indian Motorcycle Scout Bobber + Tech's Wireless Control Module (WCM) allows an adjacent-network attacker with write access to the in-vehicle network to irreversibly immobilize the motorcycle by deliberately tripping an immobilizer lockout counter that persists across power cycles. The WCM's lockout counter accepts increments from any unauthenticated message without session binding, meaning a small number of crafted in-vehicle network frames is sufficient to trigger a permanent lockout condition requiring dealer intervention to resolve. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog, though the attack technique is straightforward given adjacent network access.
Technical ContextAI
The affected component is the Wireless Control Module (WCM), the subsystem responsible for immobilizer authentication in the 2025 Indian Motorcycle Scout Bobber + Tech (CPE: cpe:2.3:a:indian_motorcycle_(polaris_inc.):scout_bobber_+_tech:*:*:*:*:*:*:*:*). The WCM implements an anti-brute-force lockout on its immobilizer authentication algorithm - a standard automotive security control - but the underlying design flaw (CWE-400: Uncontrolled Resource Consumption) is that the lockout counter is a shared, globally accessible resource: it increments on receipt of any unauthenticated message on the in-vehicle network, lacks session binding to prevent replay or spoofing, and critically does not reset on power cycle. This means the counter is a depletable resource that can be exhausted by any frame source on the bus, not only by a legitimate key-fob authentication attempt. The in-vehicle network in question is almost certainly a CAN bus or similar automotive bus accessible via physical ports such as the OBD-II connector. The ASRG (Automotive Security Research Group) reported this finding, and specific lockout thresholds have been withheld pending vendor remediation.
RemediationAI
No vendor-released patch has been identified at time of analysis; the CVE description explicitly states that specific lockout thresholds have been withheld pending vendor remediation, indicating Polaris Inc. is aware but has not published a fix. Owners and fleet operators should consult Indian Motorcycle / Polaris Inc. directly for firmware updates as they become available. As a compensating control, physical access to the in-vehicle network interface (typically the OBD-II port or diagnostic connector) should be restricted - for example, using OBD port locks or restricting physical access to the motorcycle when unattended. Note that this control reduces but does not eliminate risk, as other physical access paths to the CAN bus may exist. Dealers should also be prepared to reset the lockout counter for affected units. No references to a vendor security advisory were present in the provided data.
More in Scout Bobber Tech
View allCAN bus error-frame injection on the 2025 Indian Motorcycle Scout Bobber + Tech defeats the Wireless Control Module (WCM
Anti-theft bypass in the 2025 Indian Motorcycle Scout Bobber + Tech allows a physical attacker who can access the Wirele
Immobilizer bypass in the 2025 Indian Motorcycle Scout Bobber + Tech (Polaris Inc.) allows a physically adjacent attacke
The Wireless Control Module (WCM) in the 2025 Indian Motorcycle Scout Bobber + Tech exposes the user-set vehicle unlock
PIN screen authentication bypass in the 2025 Indian Motorcycle Scout Bobber + Tech Infotainment / Digital Round display
PIN entry bypass in the Indian Motorcycle Scout Bobber + Tech 2025 infotainment system allows an attacker with physical
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today