CVE-2026-49322

Weak authentication in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with read access to the in-vehicle network to recover the user-set unlock PIN by passively observing a single PIN authentication exchange. The Infotainment Digital Round display computes its response using a non-cryptographic operation rather than a cryptographic challenge-response, so the PIN is mathematically derivable from one captured exchange, defeating the motorcycle's primary user-authentication control. Specific protocol details have been withheld pending vendor remediation.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.7 / Impact : 3.6

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.asrg.io/security-advisories/cve-2026-49322-indian-scout-infotainment-wcm-weak-authentication

Configurations

No configuration.

History

No history.

Information

Published : 2026-05-29 08:16

Updated : 2026-07-21 12:10

NVD link : CVE-2026-49322

Mitre link : CVE-2026-49322

CVE.ORG link : CVE-2026-49322

JSON object : View

Products Affected

No product.

CWE

CWE-294

Authentication Bypass by Capture-replay

CWE-327

Use of a Broken or Risky Cryptographic Algorithm

CWE-1390

Weak Authentication

{"id": "CVE-2026-49322", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49322", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-29T15:01:05.171770Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@asrg.io", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.7}], "cvssMetricV40": [{"type": "Secondary", "source": "cve@asrg.io", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.1, "Automatable": "NOT_DEFINED", "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cve@asrg.io", "affectedData": [{"vendor": "Indian Motorcycle", "modules": ["Wireless Control Module (WCM)", "Infotainment / Digital Round"], "product": "Scout Bobber + Tech", "versions": [{"status": "affected", "version": "2025", "versionType": "model-year"}], "platforms": ["OEM Motorcycle"], "defaultStatus": "unknown"}]}], "published": "2026-05-29T08:16:19.060", "references": [{"url": "https://www.asrg.io/security-advisories/cve-2026-49322-indian-scout-infotainment-wcm-weak-authentication", "source": "cve@asrg.io"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cve@asrg.io", "description": [{"lang": "en", "value": "CWE-294"}, {"lang": "en", "value": "CWE-327"}, {"lang": "en", "value": "CWE-1390"}]}], "descriptions": [{"lang": "en", "value": "Weak authentication in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with read access to the in-vehicle network to recover the user-set unlock PIN by passively observing a single PIN authentication exchange. The Infotainment Digital Round display computes its response using a non-cryptographic operation rather than a cryptographic challenge-response, so the PIN is mathematically derivable from one captured exchange, defeating the motorcycle's primary user-authentication control. Specific protocol details have been withheld pending vendor remediation."}, {"lang": "es", "value": "Autenticaci\u00f3n d\u00e9bil en el M\u00f3dulo de Control Inal\u00e1mbrico (WCM) de la motocicleta Indian Motorcycle Scout Bobber + Tech a\u00f1o modelo 2025 permite a un atacante de red adyacente con acceso de lectura a la red del veh\u00edculo recuperar el PIN de desbloqueo establecido por el usuario observando pasivamente un \u00fanico intercambio de autenticaci\u00f3n de PIN. La pantalla Infotainment Digital Round calcula su respuesta utilizando una operaci\u00f3n no criptogr\u00e1fica en lugar de un desaf\u00edo-respuesta criptogr\u00e1fico, por lo que el PIN es matem\u00e1ticamente derivable de un intercambio capturado, derrotando el control principal de autenticaci\u00f3n de usuario de la motocicleta. Los detalles espec\u00edficos del protocolo han sido retenidos a la espera de la remediaci\u00f3n del proveedor."}], "lastModified": "2026-07-21T12:10:00.090", "sourceIdentifier": "cve@asrg.io"}