CVE-2026-49316: Indian Motorcycle Auth Bypass Vulnerability

CVE-2026-49316 Overview

CVE-2026-49316 is an expected behavior violation [CWE-440] in the in-vehicle network of the 2025 Indian Motorcycle Scout Bobber + Tech. An adjacent-network attacker with physical access to the Controller Area Network (CAN) bus can bypass the motorcycle's anti-theft shutdown. The attacker forces the Wireless Control Module (WCM) into the CAN bus-off state using a known error-frame injection technique. Once the WCM stops transmitting, peer Electronic Control Units (ECUs) do not interpret the silence as a security event. The motorcycle can then be operated even though the immobilizer was never unlocked.

Critical Impact
An attacker with physical CAN bus access can defeat the factory immobilizer and operate the motorcycle without authorization.

Affected Products

Indian Motorcycle Scout Bobber + Tech, 2025 model year
Wireless Control Module (WCM) firmware on the affected model
In-vehicle CAN network of the affected model

Discovery Timeline

2026-05-29 - CVE-2026-49316 published to NVD
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2026-49316

Vulnerability Analysis

The vulnerability targets the fault-confinement mechanism defined in the CAN protocol. Each CAN controller maintains a Transmit Error Counter (TEC). When the TEC crosses 255, the controller enters the bus-off state and ceases transmitting. The WCM on the affected motorcycle relies on the CAN bus to deliver its anti-theft shutdown command when the immobilizer has not been unlocked. By forcing the WCM into bus-off, the attacker prevents that shutdown message from ever reaching the peer ECUs. The remaining ECUs treat the absence of WCM traffic as a benign condition rather than a tamper indicator and continue normal vehicle operation. The flaw is therefore not in the CAN controller itself but in the security model of the surrounding ECUs, which fail to enforce a positive authorization signal from the WCM.

Root Cause

The root cause is a design-level expected behavior violation [CWE-440]. The anti-theft architecture assumes the WCM will always be able to assert a shutdown command, and peer ECUs treat WCM silence as equivalent to authorized operation. There is no liveness check, no signed heartbeat, and no fail-secure default when WCM messages disappear from the bus.

Attack Vector

The attacker requires physical or adjacent access to the motorcycle's CAN wiring. Using a CAN interface, the attacker monitors the WCM's periodic transmission and injects dominant bits during that transmission to generate bit errors. Each error increments the WCM's TEC. After enough induced errors, the TEC exceeds the bus-off threshold and the WCM stops transmitting all frames, including the shutdown command. The motorcycle then operates as if the immobilizer had granted authorization. Specific protocol details, including the targeted CAN identifier and timing, have been withheld pending vendor remediation.

Detection Methods for CVE-2026-49316

Indicators of Compromise

Unexpected absence of periodic WCM CAN frames during normal vehicle operation
WCM diagnostic trouble codes indicating entry into the CAN bus-off state
Elevated CAN bus error counters or repeated error frames associated with a WCM transmission window
Physical evidence of tampering with the CAN harness or diagnostic connector

Detection Strategies

Add a fail-secure liveness check in peer ECUs that treats prolonged WCM silence as a security event rather than a benign condition
Log CAN controller error counter transitions and bus-off recovery events for forensic review
Correlate immobilizer state with ignition and run state to flag operation without a successful unlock sequence

Monitoring Recommendations

Capture and retain CAN traffic during service intervals to identify error-frame injection patterns
Monitor for ECUs that enter and exit bus-off outside of expected fault scenarios
Track unauthorized access attempts to the OBD-II or diagnostic port on fleet-managed motorcycles

How to Mitigate CVE-2026-49316

Immediate Actions Required

Restrict physical access to the motorcycle's CAN harness and diagnostic connector
Contact Indian Motorcycle and authorized dealers for guidance and any available service bulletin
For fleet operators, use secondary mechanical or telematics-based anti-theft controls until a firmware fix is available

Patch Information

No vendor patch is publicly listed in the NVD record at the time of publication. Specific protocol details have been withheld pending vendor remediation. Owners should monitor Indian Motorcycle service communications for an official firmware update addressing the WCM fault-confinement behavior.

Workarounds

Add a supplemental immobilizer or mechanical lock that does not depend on the WCM CAN signal
Use a GPS or cellular telematics device that reports unauthorized motion independent of the CAN bus
Store the motorcycle in a controlled location to prevent attackers from connecting to the in-vehicle network