PT-2026-34184 · Zero Motorcycles · Zero Motorcycles Firmware

Persephone Karnstein · Published 2026-04-21 · Updated 2026-04-26 · CVE-2026-1354

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zero Motorcycles firmware versions 44 and prior

Description An issue in the Bluetooth pairing process allows an attacker in close proximity to forcibly pair a device with the motorcycle while it is in pairing mode. Once paired, the attacker can use the over-the-air firmware updating functionality to upload malicious firmware to the vehicle. Real-world incidents have occurred where this was exploited to compromise vehicle functions.

Recommendations Update firmware to a version later than 44.

Fix

Weakness Enumeration

CWE-322

Related Identifiers

CVE-2026-1354

Affected Products

Zero Motorcycles Firmware

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-1354 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-111-06.json · Note
• https://twitter.com/aviatrixtrc/status/2046997838798668141 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-26-111-06 · Note
• https://twitter.com/CVEnew/status/2048481090805887385 · Twitter Post