Scout Bobber + Tech EUVD-2026-33313

Q: What is the CVSS score of EUVD-2026-33313?

EUVD-2026-33313 has a CVSS 4.0 base score of 1.0 (Low). CVSS vector: CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-49318 LOW

Incorrect Behavior Order (CWE-696)

2026-05-29 ASRG

GHSA-mv66-48p3-pfm6

Authentication Bypass Scout Bobber Tech

1.0

CVSS 4.0 · Vendor: ASRG

Severity by source

Vendor (ASRG) PRIMARY

1.0 LOW

CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (ASRG) · only source for this CVE.

CVSS VectorVendor: ASRG

CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

May 29, 2026 - 14:22 NVD

2.4 (LOW) 1.0 (LOW)

Analysis Generated

May 29, 2026 - 14:21 vuln.today

DescriptionCVE.org

Incorrect behavior order in the Infotainment / Digital Round display of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypass the PIN entry screen. The Infotainment uses presence of Wireless Control Module (WCM) traffic during its boot window as a proxy for whether an immobilizer is fitted; if no WCM messages are observed, it skips the PIN entry screen and shows the normal user interface. An attacker who silences the WCM during the boot window - for example via a separately tracked CAN bus-off technique - can present a fully unlocked Infotainment despite the PIN never being entered. Specific timing and protocol details have been withheld pending vendor remediation.

AnalysisAI

PIN screen authentication bypass in the 2025 Indian Motorcycle Scout Bobber + Tech Infotainment / Digital Round display allows a physically proximate attacker to reach the fully unlocked user interface without entering a PIN. The system's boot-sequence logic (CWE-696) uses the mere presence of Wireless Control Module (WCM) CAN bus traffic as a proxy for immobilizer-fitment, and silently drops the PIN gate when no WCM messages appear - a condition an attacker can manufacture by suppressing the WCM via a CAN bus-off technique during the boot window. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV.

Technical ContextAI

The affected component is the Infotainment / Digital Round display embedded in the 2025 Indian Motorcycle Scout Bobber + Tech, manufactured by Polaris Inc. (CPE: cpe:2.3:a:indian_motorcycle_(polaris_inc.):scout_bobber_+_tech:*:*:*:*:*:*:*:*). The root cause is CWE-696 (Incorrect Behavior Order): the system makes an authorization decision - whether to enforce PIN entry - before it has reliably established the security-relevant environmental state (immobilizer presence). The Infotainment passively monitors CAN bus traffic from the Wireless Control Module during a boot window and treats the absence of WCM messages as a signal that no immobilizer is fitted, at which point it skips the PIN screen. This is a classic 'security gate derived from an unauthenticated, manipulable environmental signal' anti-pattern: because the WCM's CAN bus presence can be suppressed by an attacker using a CAN bus-off fault injection - a separately characterized technique - the authentication decision is effectively externally controllable. The attack surface is the vehicle's CAN bus network, most readily accessed through the OBD-II diagnostic port.

RemediationAI

No vendor-released patch has been identified at time of analysis. The disclosure notes that specific timing and protocol details have been withheld pending vendor remediation, indicating active coordination between ASRG and Indian Motorcycle / Polaris Inc. is underway - monitor Polaris security channels for a firmware update. As an actionable compensating control, restrict physical access to the vehicle's OBD-II diagnostic port (e.g., OBD-II port locks are commercially available) to eliminate the most accessible CAN bus entry point required for the bus-off attack; note this does not fix the underlying logic flaw and does not prevent exploitation via interior wiring access. Fleet operators should also ensure vehicles are stored in access-controlled environments to limit the physical proximity precondition. Disabling or physically isolating WCM harness access during unattended storage is an option but will disrupt WCM-dependent functionality and is not recommended without vendor guidance. No vendor advisory URL is available from provided references.