CVE-2026-49324

Vulnerability

The Wireless Control Module (WCM) in the Indian Motorcycle Scout Bobber + Tech 2025 model year suffers from uncontrolled resource consumption (CWE-400 [1]). The WCM enforces a brute-force lockout on the immobilizer authentication algorithm, but the lockout counter is reachable by any unauthenticated message, has no session binding, and does not reset on power cycle [2]. This allows an attacker to permanently lock the immobilizer by sending a small number of crafted frames.

Exploitation

An attacker with write access to the in-vehicle network (adjacent network position) can send unauthenticated messages to the WCM. Because the lockout counter is not bound to a session and does not reset, the attacker can deliberately trip the lockout threshold with a small number of crafted frames [2]. No authentication or user interaction is required beyond network access.

Impact

Successful exploitation permanently immobilizes the motorcycle; the bike cannot be started until dealer service intervenes [2]. This constitutes a denial of service (availability impact) with no recovery path for the owner.

Mitigation

The vendor has not yet released a fix; specific thresholds have been withheld pending remediation [2]. Recommended remediation includes binding the brute-force counter to an authorized WCM-to-ECM session token, rate-limiting on a sliding window, and providing an owner-recoverable unlock path (e.g., PIN re-entry at the Digital Round) instead of dealer-only recovery [2]. No CVE listing in KEV at this time.