Weak Authentication Issue in Indian Motorcycle Scout Bobber + Tech Wireless Control Module

CVE-2026-49323

What is CVE-2026-49323?

A significant vulnerability exists in the Wireless Control Module (WCM) of the 2025 Indian Motorcycle Scout Bobber + Tech model, which suffers from weak authentication mechanisms. This flaw allows an adjacent-network attacker, who has the ability to read the in-vehicle network traffic, to capture a single seed/key exchange between the WCM and the Engine Control Module (ECM). By exploiting this vulnerability, an attacker can reconstruct the ECM's immobilizer secret using a reversible, non-cryptographic operation. This enables unauthorized authentication to the ECM, allowing the attacker to start the motorcycle engine and bypass the immobilizer system. Details of the specific protocol have been withheld by the vendor to address the potential risks.

References