CVE-2026-49324 Overview
CVE-2026-49324 is an uncontrolled resource consumption vulnerability [CWE-307] in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year. The WCM enforces a brute-force lockout on its immobilizer authentication algorithm. However, the lockout counter is reachable by any unauthenticated message, has no session binding, and does not reset on power cycle.
An attacker with write access to the in-vehicle network can deliberately trip the lockout with a small number of crafted frames. The motorcycle becomes un-startable until dealer service restores the immobilizer state.
Critical Impact
An adjacent-network attacker can permanently immobilize the targeted motorcycle until dealer intervention, producing a persistent availability loss on safety-relevant vehicle functions.
Affected Products
- Indian Motorcycle Scout Bobber + Tech, 2025 model year
- Wireless Control Module (WCM) component
- Immobilizer authentication subsystem on the in-vehicle network
Discovery Timeline
- 2026-05-29 - CVE-2026-49324 published to the National Vulnerability Database (NVD)
- 2026-05-29 - Last updated in NVD database
Technical Details for CVE-2026-49324
Vulnerability Analysis
The WCM implements a brute-force lockout intended to defeat guessing attacks against the immobilizer authentication algorithm. The defensive control itself becomes the attack surface. Any node with write access to the in-vehicle network can address the WCM and increment the lockout counter without first establishing a session or proving identity.
Because the counter is global rather than scoped to a session, source, or message origin, an attacker does not need to defeat authentication to trigger it. Because the counter is non-volatile, a power cycle does not clear the lockout. The result is a durable denial-of-service state on a safety-relevant subsystem. Specific frame counts and thresholds have been withheld pending vendor remediation.
Root Cause
The root cause is improper restriction of excessive authentication attempts [CWE-307] combined with missing session binding on the failure counter. The lockout logic counts failed attempts globally and persists the count across power cycles. A protective rate-limit becomes a one-way switch that an unauthenticated party can flip.
Attack Vector
The attacker requires adjacent access to the in-vehicle network with the ability to write frames addressed to the WCM. This typically implies prior physical access to a diagnostic port, an exposed bus, or a compromised connected component on the vehicle network. No user interaction and no authentication are required once that access is obtained.
No public proof-of-concept code is available. The vulnerability mechanism is described in the ASRG Security Advisory CVE-2026-49324.
Detection Methods for CVE-2026-49324
Indicators of Compromise
- Motorcycles failing to start with immobilizer fault codes that persist across battery disconnect and power cycle.
- Unexpected diagnostic sessions or unsolicited write traffic to the WCM observed on the in-vehicle network.
- Service records showing repeat immobilizer lockout events on the same vehicle without owner-side key issues.
Detection Strategies
- Inspect in-vehicle network captures for repeated authentication-related messages directed at the WCM in short windows.
- Correlate immobilizer lockout diagnostic trouble codes (DTCs) with recent connection of aftermarket dongles or third-party telematics hardware.
- Where fleet telemetry is available, alert on authentication failure counters from the WCM approaching the lockout threshold.
Monitoring Recommendations
- Log and review all diagnostic-port connections and OBD-style sessions on managed fleet vehicles.
- Track repeated immobilizer DTCs across the fleet to identify clustering that may indicate a deliberate campaign.
- Establish a process for dealers to capture and forward the WCM event log when a persistent lockout is reported.
How to Mitigate CVE-2026-49324
Immediate Actions Required
- Restrict physical access to the motorcycle and to any diagnostic connectors that bridge to the in-vehicle network.
- Remove untrusted aftermarket devices, dongles, and telematics units connected to the vehicle bus until a vendor fix is available.
- Report any persistent immobilizer lockout to an authorized Indian Motorcycle dealer for investigation and reset.
Patch Information
No vendor patch is referenced in the NVD entry at time of publication. Specific lockout thresholds have been withheld pending vendor remediation. Owners and fleet operators should monitor Indian Motorcycle service bulletins and the ASRG Security Advisory CVE-2026-49324 for updates.
Workarounds
- Treat the diagnostic port as a privileged interface and keep the motorcycle physically secured when unattended.
- Do not connect unverified third-party hardware to the vehicle network, including consumer OBD readers of unknown provenance.
- For fleet or rental deployments, consider tamper-evident covers on diagnostic connectors and document inspection on handover.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
