Scout Bobber Tech EUVD-2026-33292

Q: What is the CVSS score of EUVD-2026-33292?

EUVD-2026-33292 has a CVSS 4.0 base score of 4.1 (Medium). CVSS vector: CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-49325 MEDIUM

Improper Handling of Physical or Environmental Conditions (CWE-1384)

2026-05-29 ASRG

GHSA-c9x8-xp9p-g29g

Authentication Bypass Scout Bobber Tech

4.1

CVSS 4.0 · Vendor: ASRG

Severity by source

Vendor (ASRG) PRIMARY

4.1 MEDIUM

CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (ASRG) · only source for this CVE.

CVSS VectorVendor: ASRG

CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

May 29, 2026 - 14:22 NVD

4.6 (MEDIUM) 4.1 (MEDIUM)

Analysis Generated

May 29, 2026 - 14:21 vuln.today

DescriptionCVE.org

Improper handling of physical conditions in the bike-shutdown control of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows a physical attacker with access to the Wireless Control Module (WCM) wiring harness to bypass the anti-theft shutdown. The WCM signals shutdown to a peer ECU via a falling-edge voltage transition on a dedicated wire pair. The receiving ECU does not distinguish between an active shutdown pulse and an open-circuit / disconnected condition; interrupting the relevant wires leaves the motorcycle fully operable even though the WCM never validated the rider's PIN. Specific connector details have been withheld pending vendor remediation.

AnalysisAI

Anti-theft bypass in the 2025 Indian Motorcycle Scout Bobber + Tech allows a physical attacker who can access the Wireless Control Module wiring harness to leave the motorcycle fully operable without ever supplying a valid rider PIN. The root flaw is a fail-open ECU design: the peer ECU cannot distinguish an authenticated WCM shutdown pulse from a simple open-circuit condition caused by disconnecting the relevant wire pair, so wire interruption silently suppresses the immobilizer. Reported by ASRG under coordinated disclosure with connector details withheld; no public exploit has been identified and the vulnerability is not confirmed actively exploited (CISA KEV).

Technical ContextAI

The Scout Bobber + Tech employs a Wireless Control Module that communicates anti-theft shutdown commands to a peer Engine Control Unit using a falling-edge voltage transition on a dedicated analog wire pair - a single-ended, voltage-level signaling scheme. CWE-1384 (Improper Handling of Physical Conditions) precisely describes the root cause: the receiving ECU applies fail-open logic, treating the absence of a valid signal identically to an authorized run state. A secure design would require the ECU to default to immobilization (fail-secure) whenever the shutdown wire is in an indeterminate or open-circuit state. The CPE cpe:2.3:a:indian_motorcycle_(polaris_inc.):scout_bobber_+_tech:*:*:*:*:*:*:*:* uses a wildcard version field, indicating no unaffected firmware revision has been identified. This is an embedded automotive firmware issue under Polaris Inc.'s product line.

RemediationAI

No vendor-released patch has been identified at time of analysis; Polaris Inc. and Indian Motorcycle have not yet published an advisory or firmware fix. ASRG has intentionally withheld specific connector and wire pair details pending vendor remediation, so owners should monitor Indian Motorcycle's official communications and the ASRG disclosure channel for patch availability. As immediate compensating controls, owners should use supplemental physical security measures - disc locks, chain locks secured to immovable objects, or motorcycle covers that conceal body panel access points - to extend the time and visibility required for an attacker to access the WCM harness. GPS tracking devices can support recovery if theft occurs. When a firmware update is released, it should be prioritized: the correct fix is fail-secure ECU logic that treats an open-circuit or disconnected shutdown wire as an immobilization command rather than an operational signal.