Uncontrolled Resource Consumption in Indian Motorcycle Scout Bobber + Tech 2025

CVE-2026-49324

What is CVE-2026-49324?

The Wireless Control Module (WCM) in the Indian Motorcycle Scout Bobber + Tech 2025 model year is susceptible to an uncontrolled resource consumption vulnerability. This flaw allows an adjacent network attacker with write access to the in-vehicle network to immobilize the motorcycle by exploiting the brute-force lockout mechanism of the immobilizer authentication algorithm. The lockout counter can be manipulated via unauthenticated messages, which lack session binding and do not reset upon power cycling. As a result, an attacker can quickly trigger the lockout condition using crafted messages, rendering the motorcycle inoperable until serviced by a dealer.

References