Zero Motorcycles Firmware
Monthly
Forced Bluetooth pairing in Zero Motorcycles firmware versions 44 and prior enables an adjacent attacker to bypass device authentication and inject malicious over-the-air firmware updates onto affected motorcycles. Rooted in CWE-322 (Key Exchange without Entity Authentication), the flaw allows an unauthorized device to complete the pairing process without any credential verification, after which the attacker can abuse the legitimate OTA update channel to replace vehicle firmware with attacker-controlled code. No public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis, though the ICS-CERT advisory and physical-safety implications elevate the operational significance beyond the moderate CVSS 4.0 score of 5.9.
Forced Bluetooth pairing in Zero Motorcycles firmware versions 44 and prior enables an adjacent attacker to bypass device authentication and inject malicious over-the-air firmware updates onto affected motorcycles. Rooted in CWE-322 (Key Exchange without Entity Authentication), the flaw allows an unauthorized device to complete the pairing process without any credential verification, after which the attacker can abuse the legitimate OTA update channel to replace vehicle firmware with attacker-controlled code. No public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis, though the ICS-CERT advisory and physical-safety implications elevate the operational significance beyond the moderate CVSS 4.0 score of 5.9.