CVE-2026-49316
CAN Bus-Off State Vulnerability in Indian Motorcycle Scout Bobber + Tech 2025
Publication date: 2026-05-29
Last updated on: 2026-05-29
Assigner: Automotive Security Research Group (ASRG)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| indian_motorcycle | scout_bobber | 2025 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-693 | The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. |
| CWE-440 | A feature, API, or function does not perform according to its specification. |
| CWE-754 | The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an expected behavior violation in the in-vehicle network of the Indian Motorcycle Scout Bobber + Tech 2025 model year. An attacker on an adjacent network can exploit this by forcing the Wireless Control Module (WCM) into a CAN bus-off state using a known CAN error-frame injection technique. When the WCM enters this state, it stops transmitting all messages, including the anti-theft shutdown command. Other electronic control units (ECUs) do not recognize the WCM's silence as a security issue and continue normal operation, allowing the motorcycle to be operated even though the immobilizer has not been unlocked.
How can this vulnerability impact me? :
The impact of this vulnerability is that an attacker can bypass the motorcycle's anti-theft system, allowing unauthorized operation of the vehicle. Since the Wireless Control Module stops sending shutdown commands and other ECUs do not detect this as a security event, the motorcycle can be started and used despite the immobilizer remaining locked. This effectively disables the anti-theft protection, increasing the risk of theft.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.