PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-49318 Indian Motorcycle (Polaris Inc.) CVE debrief

A logic flaw in the Indian Motorcycle Scout Bobber + Tech 2025 infotainment system allows an adjacent-network attacker to bypass the PIN entry screen by suppressing Wireless Control Module (WCM) traffic during the boot window. The system uses WCM message presence as a proxy for immobilizer presence; absence of these messages causes the infotainment to skip PIN verification and present an unlocked interface. This represents an incorrect behavior order (CWE-696) where security-critical state validation depends on an unreliable environmental signal rather than explicit authentication success. The attack requires physical proximity to the vehicle's CAN bus and precise timing during system boot, with specific technical details withheld pending vendor remediation.

Vendor
Indian Motorcycle (Polaris Inc.)
Product
Scout Bobber + Tech
CVSS
LOW 1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-05-29
Advisory published
2026-05-29
Advisory updated
2026-05-29

Who should care

Owners and operators of Indian Motorcycle Scout Bobber + Tech 2025 model year vehicles; automotive security researchers; fleet managers with motorcycle deployments; physical security teams responsible for vehicle access controls; incident responders investigating suspicious vehicle electronic behavior

Technical summary

The vulnerability stems from architectural reliance on WCM traffic presence as an implicit security signal. During infotainment boot, the system checks for WCM messages to determine immobilizer configuration; if none are detected, it assumes no immobilizer is fitted and proceeds directly to the unlocked user interface. This design fails to distinguish between 'no immobilizer fitted' and 'immobilizer communication disrupted' states. An attacker with adjacent network access (CAN bus connectivity) who can induce WCM silence during the critical boot window—through separately tracked CAN bus-off techniques or other denial-of-service methods against WCM traffic—can cause the infotainment to skip PIN entry entirely. The attack requires physical proximity, precise timing aligned with system boot, and capability to manipulate vehicle network traffic. The CVSS 4.0 scoring reflects physical attack vector constraints and limited impact scope (confidentiality only, low severity), though operational impact may be higher in contexts where infotainment access enables further attack chaining.

Defensive priority

LOW

Recommended defensive actions

  • Contact Indian Motorcycle authorized service centers to inquire about firmware updates addressing infotainment boot-time security validation
  • Implement physical security controls to prevent unauthorized CAN bus access to vehicles
  • Monitor for unusual vehicle electrical behavior during startup that may indicate attempted exploitation
  • Consider aftermarket CAN bus monitoring solutions that detect anomalous traffic patterns during infotainment boot sequences
  • Coordinate with fleet security teams to establish vehicle startup verification procedures where PIN bypass would be operationally critical

Evidence notes

CVE published 2026-05-29T14:16:32.780Z; modified 2026-05-29T15:11:03.853Z. NVD status: Deferred. CVSS 4.0 vector indicates physical attack vector (AV:P), low attack complexity (AC:L), partial attack timing requirement (AT:P), with low confidentiality impact (VC:L) and no integrity/availability impact to the vulnerable system. Weaknesses cited: CWE-636 (Not Failing Securely), CWE-696 (Incorrect Behavior Order), CWE-754 (Improper Check for Unusual or Exceptional Conditions).

Official resources

2026-05-29