PT-2026-44851 · Indian Motorcycle · Scout Bobber + Tech 2025

Published 2026-05-29 · Updated 2026-05-29 · CVE-2026-49317

Positive Technologies (AI Summary)

CVSS v3.1

2.4

Low

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Indian Motorcycle Scout Bobber + Tech 2025 model year

Description An incorrect behavior order in the Infotainment / Digital Round display allows an attacker on an adjacent network to bypass the PIN entry screen. The system uses the presence of Wireless Control Module (WCM) traffic during the boot window as a proxy to determine if an immobilizer is fitted. If no WCM messages are detected, the system skips the PIN entry screen and displays the normal user interface. An attacker can achieve a fully unlocked state by silencing the WCM during the boot window, for instance, by using a CAN bus-off technique, which is a method used to force a CAN node into an error state to stop it from communicating.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-636

CWE-696

CWE-754

Related Identifiers

CVE-2026-49317

Affected Products

Scout Bobber + Tech 2025

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-49317 · Security Note
• https://twitter.com/VulmonFeeds/status/2060407387677139317 · Twitter Post
• https://cwe.mitre.org/data/definitions/696.html · Note