CVE-2026-49325: Indian Scout Bobber Auth Bypass Flaw

CVE-2026-49325 Overview

CVE-2026-49325 is a physical security weakness in the Indian Motorcycle Scout Bobber + Tech 2025 model year. The Wireless Control Module (WCM) signals an anti-theft shutdown to a peer Electronic Control Unit (ECU) using a falling-edge voltage transition on a dedicated wire pair. The receiving ECU cannot distinguish between an active shutdown pulse and an open-circuit condition. An attacker with physical access to the WCM wiring harness can interrupt the relevant wires and leave the motorcycle fully operable without rider PIN validation. The flaw is classified under CWE-693: Protection Mechanism Failure.

Critical Impact
A physical attacker can bypass the PIN-validated anti-theft shutdown by disconnecting WCM harness wires, enabling unauthorized operation of the motorcycle.

Affected Products

Indian Motorcycle Scout Bobber + Tech, 2025 model year
Wireless Control Module (WCM) firmware on the affected model
Peer ECU responsible for processing the shutdown signal

Discovery Timeline

2026-05-29 - CVE-2026-49325 published to the National Vulnerability Database
2026-05-29 - Last updated in the NVD database

Technical Details for CVE-2026-49325

Vulnerability Analysis

The vulnerability resides in the inter-ECU signaling design used to enforce the anti-theft shutdown. After a rider fails to provide a valid PIN, the WCM is expected to assert a shutdown signal to a peer ECU over a dedicated wire pair. The shutdown indication is a falling-edge voltage transition rather than an authenticated message. The receiving ECU treats a disconnected or open-circuit line identically to a normal idle state. An attacker who cuts or unplugs the relevant harness wires prevents the falling edge from ever being observed, and the peer ECU continues to allow engine operation. The defect is a protection mechanism failure rooted in fail-open behavior of a safety-relevant signal path.

Root Cause

The peer ECU implements no integrity, liveness, or sanity checks on the shutdown wire pair. There is no heartbeat, no signed message exchange, and no detection of harness tampering. Open-circuit conditions are not interpreted as a fault state, so loss of signal is silently accepted. This violates the secure default principle for safety and anti-theft logic, which should fail closed when the expected control channel is unavailable.

Attack Vector

Exploitation requires physical access to the motorcycle and to the WCM wiring harness. An attacker locates the dedicated wire pair carrying the shutdown signal, then cuts, unplugs, or otherwise interrupts the conductors. The receiving ECU never observes a shutdown transition and continues to authorize ignition and propulsion. No cryptographic material, PIN, or wireless interaction is needed. Specific connector details have been withheld by the reporter pending vendor remediation.

Detection Methods for CVE-2026-49325

Indicators of Compromise

Cut, spliced, or disconnected conductors on the WCM wiring harness near the shutdown wire pair
Aftermarket connectors, jumpers, or tape splices not present in the factory build
Motorcycle operation without successful PIN entry recorded in WCM logs
Mismatch between WCM event history and peer ECU runtime telemetry

Detection Strategies

Compare WCM authentication events against peer ECU ignition and propulsion logs during dealer service intervals
Add diagnostic trouble codes (DTCs) that flag continuous-open conditions on the shutdown wire pair
Inspect the WCM harness during scheduled maintenance for evidence of tampering or modification

Monitoring Recommendations

Fleet operators should require post-service harness inspections and store baseline photographs of factory wiring
Review CAN bus traces, where available, for ignition activity that lacks a preceding PIN-validated authorization event
Track vehicles that report repeated WCM communication faults for possible tamper investigation

How to Mitigate CVE-2026-49325

Immediate Actions Required

Park affected motorcycles in physically secured locations until a vendor remediation is available
Use secondary mechanical anti-theft devices such as disc locks, chains, or ground anchors
Restrict harness access by inspecting and securing fairings, side panels, and seat assemblies

Patch Information

No vendor patch or firmware update has been published at the time of NVD entry. Specific connector and wiring details have been withheld pending vendor remediation. Owners should monitor official Indian Motorcycle service bulletins and contact authorized dealers for updates.

Workarounds

Install a supplemental immobilizer that fails closed on harness disconnection
Add tamper-evident seals or potting around exposed WCM connectors to make interference visible
Use GPS-based tracking devices independent of the WCM to recover stolen vehicles

bash

# No software configuration mitigation is available.
# Refer to authorized dealer service bulletins for any future firmware updates.