CVE-2026-49317

Vulnerability

The Infotainment / Digital Round display in the Indian Motorcycle Scout Bobber + Tech 2025 model year has an incorrect behavior order [1]: it uses the presence of Wireless Control Module (WCM) traffic during its boot window as a proxy for whether an immobilizer is fitted. If no WCM messages are observed, the system skips the PIN entry screen and shows the normal user interface. Affected versions are those shipped with the 2025 model year vehicle; no specific firmware version has been disclosed.

Exploitation

An adjacent-network attacker can exploit this by silencing the WCM during the boot window. Using a CAN bus-off technique (tracked separately), the attacker disrupts WCM communication precisely when the Infotainment is booting. The attacker must be in close proximity to the vehicle to inject or interfere with CAN traffic. No authentication or user interaction is required.

Impact

Successful exploitation allows the attacker to present a fully unlocked Infotainment interface without entering the PIN. This can lead to disclosure of sensitive information stored on the system (e.g., contacts, trip history) and may allow unauthorized modification of vehicle settings. The attacker gains a level of access normally restricted to an authenticated user.

Mitigation

As of the publication date (2026-05-29), no fix has been released. The vendor has been notified and remediation is pending. Specific timing and protocol details have been withheld to facilitate a patch. No workaround is currently available. The vulnerability is not listed on CISA's KEV.