CVE-2026-49324
Indian Scout Bobber 2025 WCM brute-force
- Published
- Updated
- Reserved
- Assigned by
- ASRG
Description
Uncontrolled resource consumption in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with write access to the in-vehicle network to permanently immobilize the motorcycle. The WCM enforces a brute-force lockout on the immobilizer authentication algorithm, but the lockout counter is reachable by any unauthenticated message, has no session binding, and does not reset on power cycle. An attacker can deliberately trip the lockout with a small number of crafted frames, leaving the bike un-startable until dealer service. Specific thresholds have been withheld pending vendor remediation.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| ASRGCNA (assigner) | 4.0 | Medium4.1 | CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| ASRGCNA (assigner) | 3.1 | Medium4.6 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Deferred | 4.0 | Medium4.1 | CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.17% · top 93% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.1.
Weakness
- CWE-400 Uncontrolled Resource Consumption (opens in a new tab)All about CWE-400 and its CVEs
- CWE-307 Improper Restriction of Excessive Authentication Attempts (opens in a new tab)All about CWE-307 and its CVEs
- CWE-770 Allocation of Resources Without Limits or Throttling (opens in a new tab)All about CWE-770 and its CVEs
Affected products
Indian Motorcycle · Scout Bobber + Tech
- affected 2025
What to do
Solution: Bind the brute-force counter to an authorized WCM↔ECM session token, rate-limit on a sliding window, and provide an owner-recoverable unlock path (e.g., PIN re-entry at the Digital Round) instead of dealer-only recovery.
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-49324)Record last updated .