Zero Motorcycles Firmware up to 44 Update key exchange without entity authentication

Summaryinfo

A vulnerability marked as problematic has been reported in Zero Motorcycles Firmware up to 44. Affected by this issue is some unknown functionality of the component Update Handler. The manipulation leads to key exchange without entity authentication. This vulnerability is listed as CVE-2026-1354. The attack must be carried out from within the local network. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Zero Motorcycles Firmware up to 44. This issue affects an unknown code of the component Update Handler. The manipulation with an unknown input leads to a key exchange without entity authentication vulnerability. Using CWE to declare the problem leads to CWE-322. The product performs a key exchange with an actor without verifying the identity of that actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Zero Motorcycles firmware versions 44 and prior enable an attacker to forcibly pair a device with the motorcycle via Bluetooth. Once paired, an attacker can utilize over-the-air firmware updating functionality to potentially upload malicious firmware to the motorcycle. The motorcycle must first be in Bluetooth pairing mode, and the attacker must be in proximity of the vehicle and understand the full pairing process, to be able to pair their device with the vehicle. The attacker's device must remain paired with and in proximity of the motorcycle for the entire duration of the firmware update.

The weakness was presented by Persephone Karnstein as icsa-26-111-06. The advisory is shared at cisa.gov. The identification of this vulnerability is CVE-2026-1354 since 01/22/2026. The exploitation is known to be difficult. The attack needs to be initiated within the local network. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/22/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Firmware Software

Vendor

• Zero Motorcycles

Name

• Firmware

Version

• 44

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion