Indian Motorcycle Scout Bobber and Tech 2025 incorrect behavior order

Summaryinfo

A vulnerability has been found in Indian Motorcycle Scout Bobber and Tech 2025 and classified as problematic. This affects an unknown part. This manipulation causes incorrect behavior order. This vulnerability is tracked as CVE-2026-49317. It is feasible to perform the attack on the physical device. No exploit exists.

Detailsinfo

A vulnerability classified as problematic was found in Indian Motorcycle Scout Bobber and Tech 2025. Affected by this vulnerability is an unknown part. The manipulation with an unknown input leads to a incorrect behavior order vulnerability. The CWE definition for the vulnerability is CWE-696. The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways which may produce resultant weaknesses. As an impact it is known to affect confidentiality. The summary by CVE is:

Incorrect behavior order in the Infotainment / Digital Round display of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypass the PIN entry screen. The Infotainment uses presence of Wireless Control Module (WCM) traffic during its boot window as a proxy for whether an immobilizer is fitted; if no WCM messages are observed, it skips the PIN entry screen and shows the normal user interface. An attacker who silences the WCM during the boot window — for example via a separately tracked CAN bus-off technique — can present a fully unlocked Infotainment despite the PIN never being entered. Specific timing and protocol details have been withheld pending vendor remediation.

The weakness was disclosed by Scott Sheahan. This vulnerability is known as CVE-2026-49317 since 05/29/2026. The exploitation appears to be easy. An attack has to be approached locally. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-33296). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Indian Motorcycle

Name

• Scout Bobber and Tech

Version

• 2025

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion