CVE-2026-49322

Vulnerability

The Wireless Control Module (WCM) in the Indian Motorcycle Scout Bobber + Tech 2025 model year implements weak authentication for the user-set unlock PIN. The Infotainment Digital Round display computes its response using a non-cryptographic operation rather than a cryptographic challenge-response mechanism [1]. This design flaw allows the PIN to be mathematically derived from a single captured authentication exchange. The affected version is the 2025 model year of the Scout Bobber + Tech.

Exploitation

An attacker with adjacent-network access and read capability on the in-vehicle network can passively observe a single PIN authentication exchange between the WCM and the Infotainment display. No prior authentication or user interaction is required. By capturing the exchange, the attacker can mathematically recover the PIN due to the non-cryptographic response computation [2].

Impact

Successful exploitation yields the user-set unlock PIN, defeating the motorcycle's primary user-authentication control. This could allow the attacker to unlock and potentially operate the motorcycle, leading to unauthorized access and possible theft or misuse.

Mitigation

As of the publication date, no vendor patch has been released. The recommended remediation is to replace the non-cryptographic response computation with a digital signature (e.g., ECDSA P-256) or an HMAC over a fresh per-session random nonce, bound to a stable per-vehicle identifier to prevent cross-bike replay [2]. Users should monitor vendor advisories for a firmware update.