Scout Bobber Tech EUVD-2026-33293

The attacker must be within physical proximity to the motorcycle sufficient to reach the OBD-II port or the WCM's wireless interface - the exact required distance is unconfirmed due to a conflict between the CVE description's 'adjacent-network' characterization and the CVSS AV:P vector (see risk assessment). The WCM must be in its normal active state, periodically broadcasting immobilizer-state messages on the CAN bus; this is the default condition for any parked or running 2025 Scout Bobber + Tech with the anti-theft system engaged, requiring no non-default configuration. No authentication, credentials, or victim interaction are required (PR:N, UI:N). AT:P (Attack Requirements: Present) reflects the specific precondition that the attacker must be able to time CAN error frames to collide with WCM transmissions, requiring either direct bus wiring access or a compatible wireless CAN injection capability. Exploitation is limited by the need for proximity sufficient to sustain the injection, the requirement for CAN-capable hardware and tooling, the absence of publicly disclosed protocol specifics, and the fact that ASRG has withheld full technical details. The vulnerability does not apply to Indian Motorcycle models that do not use the WCM-based anti-theft architecture or to model years other than 2025 as currently scoped.

The CVSS 4.0 base score of 4.1 (Medium) is driven by AV:P (Physical attack vector), which bounds exploitation to actors within direct or adjacent range of the vehicle, and AT:P (Attack Requirements: Present), indicating the WCM must be actively transmitting - its normal operating state - for the attack to proceed. PR:N and UI:N confirm no credentials or victim interaction are needed once proximity is established. VA:H captures the WCM being forced bus-off. A notable analytical tension exists: the CVE description characterizes the threat actor as 'an adjacent-network attacker,' which in CVSS 4.0 terminology implies AV:A, yet the submitted vector specifies AV:P. This discrepancy is material - AV:A would allow exploitation from several meters via the WCM's wireless interface without physical contact, while AV:P requires direct bus access; defenders cannot make precise access-control decisions until this is clarified by ASRG or the vendor. The subsequent-system impact metrics (SC/SI/SA) are all rated None, which technically understates the real-world consequence: the motorcycle becomes stealable. No EPSS data was provided. No CISA KEV listing exists, indicating no confirmed widespread active exploitation. The underlying bus-off injection technique is described by ASRG as 'well-known' in automotive security research, but no public exploit tool targeting this specific vehicle has been identified, and full protocol specifics are withheld.

An attacker carrying a commodity USB-to-CAN adapter and a laptop approaches a parked 2025 Scout Bobber + Tech in a public space, accesses the CAN bus via the OBD-II diagnostic port or via the WCM wireless interface, and transmits malformed CAN error frames timed to collide with the WCM's periodic immobilizer-state broadcasts. Within seconds to minutes, the WCM's transmit error counter reaches 255 and the module enters bus-off, permanently silencing its shutdown command for the remainder of the power cycle. With no ECU issuing a lockout, the attacker starts the engine using the ignition switch and rides away; no public exploit tool exists for this specific vehicle, but the bus-off injection technique itself is documented in automotive security research literature.