PT-2026-44829 · Indian Motorcycle · Scout Bobber + Tech

Scott Sheahan · Published 2026-05-29 · Updated 2026-05-29 · CVE-2026-49323

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Indian Motorcycle Scout Bobber + Tech 2025 model year

Description Weak authentication exists between the Wireless Control Module (WCM) and the Engine Control Module (ECM). An adjacent-network attacker with read access to the in-vehicle network can recover the per-vehicle ECM immobilizer secret by passively observing a single seed/key exchange. This is possible because the WCM uses a reversible, non-cryptographic operation instead of a cryptographic challenge-response to derive its response, allowing the persistent immobilizer secret to be reconstructed from one captured exchange. An attacker possessing this secret can authenticate to the ECM independently of the WCM to start the engine, effectively bypassing the immobilizer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-798

CWE-1390

CWE-327

Related Identifiers

CVE-2026-49323

Affected Products

Scout Bobber + Tech

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-49323 · Security Note
• https://t.me/CVEtracker/55252 · Telegram Post
• https://cwe.mitre.org/data/definitions/1390.html · Note
• https://asrg.io/security-advisories/cve-2026-49323-indian-scout-wcm-ecm-weak-authentication · Note