CVE-2026-49323 Indian Scout Bobber 2025 WCM-to-ECM weak authentication
An attacker can bypass the motorcycle immobilizer and start the engine by recovering the secret key from a weak, non-cryptographic authentication exchange.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-49323?
CVE-2026-49323 is a medium-severity vulnerability in Indian Motorcycle Scout Bobber + Tech, published on 29 May 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Weak authentication between the Wireless Control Module (WCM) and the Engine Control Module (ECM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with read access to the in-vehicle network to recover the per-vehicle ECM immobilizer secret by passively observing a single seed/key exchange. The WCM derives its response using a reversible, non-cryptographic operation rather than a cryptographic challenge-response, so the persistent immobilizer secret can be reconstructed from one captured exchange. With this secret the attacker can authenticate to the ECM independently of the WCM and start the engine, defeating the immobilizer. Specific protocol details have been withheld pending vendor remediation.
Which versions are affected by CVE-2026-49323?
How do I fix CVE-2026-49323?
No fix has been published for CVE-2026-49323 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-49323 being exploited?
There is no known exploitation of CVE-2026-49323 in the wild and no public exploit code.
Sources
Also known as GHSA-f65x-w4fq-xj28.