CVE-2026-49316

Name of the Vulnerable Software and Affected Versions Indian Motorcycle Scout Bobber + Tech 2025 model year

Description An expected behavior violation in the in-vehicle network allows an adjacent-network attacker to bypass the anti-theft shutdown. By using a CAN error-frame injection technique against a periodic transmission from the Wireless Control Module (WCM), an attacker can force the WCM CAN controller's transmit error counter to exceed the bus-off threshold. This causes the WCM to enter a bus-off state and stop transmitting all messages, including the shutdown command. Because peer Electronic Control Units (ECUs) do not recognize the silence from the WCM as a security event, the motorcycle can be operated even if the immobilizer remains locked.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.