CVE-2026-49318 Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot
An adjacent attacker can bypass the infotainment PIN screen by silencing the Wireless Control Module during boot, granting unauthorized access to the user interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-49318?
CVE-2026-49318 is a low-severity authentication bypass vulnerability in Indian Motorcycle Scout Bobber + Tech, published on 29 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Incorrect behavior order in the Infotainment / Digital Round display of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypass the PIN entry screen. The Infotainment uses presence of Wireless Control Module (WCM) traffic during its boot window as a proxy for whether an immobilizer is fitted; if no WCM messages are observed, it skips the PIN entry screen and shows the normal user interface. An attacker who silences the WCM during the boot window — for example via a separately tracked CAN bus-off technique — can present a fully unlocked Infotainment despite the PIN never being entered. Specific timing and protocol details have been withheld pending vendor remediation.
Which versions are affected by CVE-2026-49318?
How do I fix CVE-2026-49318?
No fix has been published for CVE-2026-49318 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-49318 being exploited?
There is no known exploitation of CVE-2026-49318 in the wild and no public exploit code.
Sources
Also known as GHSA-mv66-48p3-pfm6.