CVE-2026-49316

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49316", "assignerOrgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "state": "PUBLISHED", "assignerShortName": "ASRG", "dateReserved": "2026-05-29T07:26:43.198Z", "datePublished": "2026-05-29T12:39:23.104Z", "dateUpdated": "2026-06-27T08:47:44.904Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "shortName": "ASRG", "dateUpdated": "2026-06-27T08:47:44.904Z"}, "title": "Indian Scout Bobber 2025 WCM CAN bus-off attack silently bypasses anti-theft shutdown", "datePublic": "2026-05-29T15:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-440", "description": "CWE-440 Expected Behavior Violation", "type": "CWE"}, {"lang": "en", "cweId": "CWE-754", "description": "CWE-754 Improper Check for Unusual or Exceptional Conditions", "type": "CWE"}, {"lang": "en", "cweId": "CWE-693", "description": "CWE-693 Protection Mechanism Failure", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Obstruction"}]}, {"descriptions": [{"lang": "en", "value": "Software Integrity Attack"}]}], "affected": [{"vendor": "Indian Motorcycle", "product": "Scout Bobber + Tech", "platforms": ["OEM Motorcycle"], "modules": ["Wireless Control Module (WCM)"], "versions": [{"status": "affected", "version": "2025", "versionType": "model-year"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "Expected behavior violation in the in-vehicle network of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypass the motorcycle's anti-theft shutdown by forcing the Wireless Control Module (WCM) into the CAN bus-off state. Using a well-known CAN error-frame injection technique against a periodic WCM transmission, the attacker drives the WCM CAN controller's transmit error counter past the bus-off threshold, after which the WCM stops transmitting all messages, including the shutdown command. Peer ECUs do not interpret WCM silence as a security event and continue normal operation, allowing the motorcycle to be operated despite the immobilizer never having been unlocked. Specific protocol details have been withheld pending vendor remediation.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Expected behavior violation in the in-vehicle network of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypass the motorcycle's anti-theft shutdown by forcing the Wireless Control Module (WCM) into the CAN bus-off state. Using a well-known CAN error-frame injection technique against a periodic WCM transmission, the attacker drives the WCM CAN controller's transmit error counter past the bus-off threshold, after which the WCM stops transmitting all messages, including the shutdown command. Peer ECUs do not interpret WCM silence as a security event and continue normal operation, allowing the motorcycle to be operated despite the immobilizer never having been unlocked. Specific protocol details have been withheld pending vendor remediation.</p>"}]}], "references": [{"url": "https://cwe.mitre.org/data/definitions/440.html", "tags": ["technical-description"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "PHYSICAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "MEDIUM", "baseScore": 4.6, "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "PHYSICAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 4.1, "vectorString": "CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "Treat absence of the WCM heartbeat as a security event in peer ECUs \u2014 command shutdown if the WCM's periodic message is missing beyond a bounded interval. Authenticate the heartbeat with AUTOSAR SecOC or equivalent to prevent post-silence spoofing. Auto-recover the WCM from bus-off and log the event.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Treat absence of the WCM heartbeat as a security event in peer ECUs \u2014 command shutdown if the WCM's periodic message is missing beyond a bounded interval. Authenticate the heartbeat with AUTOSAR SecOC or equivalent to prevent post-silence spoofing. Auto-recover the WCM from bus-off and log the event.</p>"}]}], "timeline": [{"time": "2025-03-26T00:00:00.000Z", "lang": "en", "value": "Reported to Indian Motorcycle by Rustic Security LLC (responsible disclosure)"}], "credits": [{"lang": "en", "value": "Scott Sheahan, Rustic Security LLC", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-29T15:26:52.193932Z", "id": "CVE-2026-49316", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-29T15:26:58.445Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-49316", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-29T15:26:52.193932Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-29T15:26:55.163Z"}}], "cna": {"title": "Indian Scout Bobber 2025 WCM CAN bus-off attack silently bypasses anti-theft shutdown", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Scott Sheahan, Rustic Security LLC"}], "impacts": [{"descriptions": [{"lang": "en", "value": "Obstruction"}]}, {"descriptions": [{"lang": "en", "value": "Software Integrity Attack"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.1, "Automatable": "NOT_DEFINED", "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Indian Motorcycle", "modules": ["Wireless Control Module (WCM)"], "product": "Scout Bobber + Tech", "versions": [{"status": "affected", "version": "2025", "versionType": "model-year"}], "platforms": ["OEM Motorcycle"], "defaultStatus": "unknown"}], "timeline": [{"lang": "en", "time": "2025-03-26T00:00:00.000Z", "value": "Reported to Indian Motorcycle by Rustic Security LLC (responsible disclosure)"}], "solutions": [{"lang": "en", "value": "Treat absence of the WCM heartbeat as a security event in peer ECUs \u2014 command shutdown if the WCM's periodic message is missing beyond a bounded interval. Authenticate the heartbeat with AUTOSAR SecOC or equivalent to prevent post-silence spoofing. Auto-recover the WCM from bus-off and log the event.", "supportingMedia": [{"type": "text/html", "value": "<p>Treat absence of the WCM heartbeat as a security event in peer ECUs \u2014 command shutdown if the WCM's periodic message is missing beyond a bounded interval. Authenticate the heartbeat with AUTOSAR SecOC or equivalent to prevent post-silence spoofing. Auto-recover the WCM from bus-off and log the event.</p>", "base64": false}]}], "datePublic": "2026-05-29T15:00:00.000Z", "references": [{"url": "https://cwe.mitre.org/data/definitions/440.html", "tags": ["technical-description"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Expected behavior violation in the in-vehicle network of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypass the motorcycle's anti-theft shutdown by forcing the Wireless Control Module (WCM) into the CAN bus-off state. Using a well-known CAN error-frame injection technique against a periodic WCM transmission, the attacker drives the WCM CAN controller's transmit error counter past the bus-off threshold, after which the WCM stops transmitting all messages, including the shutdown command. Peer ECUs do not interpret WCM silence as a security event and continue normal operation, allowing the motorcycle to be operated despite the immobilizer never having been unlocked. Specific protocol details have been withheld pending vendor remediation.", "supportingMedia": [{"type": "text/html", "value": "<p>Expected behavior violation in the in-vehicle network of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypass the motorcycle's anti-theft shutdown by forcing the Wireless Control Module (WCM) into the CAN bus-off state. Using a well-known CAN error-frame injection technique against a periodic WCM transmission, the attacker drives the WCM CAN controller's transmit error counter past the bus-off threshold, after which the WCM stops transmitting all messages, including the shutdown command. Peer ECUs do not interpret WCM silence as a security event and continue normal operation, allowing the motorcycle to be operated despite the immobilizer never having been unlocked. Specific protocol details have been withheld pending vendor remediation.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-440", "description": "CWE-440 Expected Behavior Violation"}, {"lang": "en", "type": "CWE", "cweId": "CWE-754", "description": "CWE-754 Improper Check for Unusual or Exceptional Conditions"}, {"lang": "en", "type": "CWE", "cweId": "CWE-693", "description": "CWE-693 Protection Mechanism Failure"}]}], "providerMetadata": {"orgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "shortName": "ASRG", "dateUpdated": "2026-06-27T08:47:44.904Z"}}}, "cveMetadata": {"cveId": "CVE-2026-49316", "state": "PUBLISHED", "dateUpdated": "2026-06-27T08:47:44.904Z", "dateReserved": "2026-05-29T07:26:43.198Z", "assignerOrgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "datePublished": "2026-05-29T12:39:23.104Z", "assignerShortName": "ASRG"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "modules": ["Wireless Control Module (WCM)"], "platforms": ["OEM Motorcycle"], "product": "Scout Bobber + Tech", "vendor": "Indian Motorcycle", "versions": [{"status": "affected", "version": "2025", "versionType": "model-year"}]}], "source": "cve@asrg.io"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Expected behavior violation in the in-vehicle network of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypass the motorcycle's anti-theft shutdown by forcing the Wireless Control Module (WCM) into the CAN bus-off state. Using a well-known CAN error-frame injection technique against a periodic WCM transmission, the attacker drives the WCM CAN controller's transmit error counter past the bus-off threshold, after which the WCM stops transmitting all messages, including the shutdown command. Peer ECUs do not interpret WCM silence as a security event and continue normal operation, allowing the motorcycle to be operated despite the immobilizer never having been unlocked. Specific protocol details have been withheld pending vendor remediation."}, {"lang": "es", "value": "Violaci\u00f3n del comportamiento esperado en la red interna del veh\u00edculo del modelo Indian Motorcycle Scout Bobber + Tech a\u00f1o 2025 permite a un atacante de red adyacente eludir el apagado antirrobo de la motocicleta forzando el M\u00f3dulo de Control Inal\u00e1mbrico (WCM) al estado de bus-off de CAN. Utilizando una t\u00e9cnica conocida de inyecci\u00f3n de tramas de error CAN contra una transmisi\u00f3n peri\u00f3dica del WCM, el atacante lleva el contador de errores de transmisi\u00f3n del controlador CAN del WCM m\u00e1s all\u00e1 del umbral de bus-off, despu\u00e9s de lo cual el WCM deja de transmitir todos los mensajes, incluyendo el comando de apagado. Las ECU pares no interpretan el silencio del WCM como un evento de seguridad y contin\u00faan su funcionamiento normal, permitiendo que la motocicleta sea operada a pesar de que el inmovilizador nunca haya sido desbloqueado. Los detalles espec\u00edficos del protocolo han sido retenidos a la espera de la remediaci\u00f3n del proveedor."}], "id": "CVE-2026-49316", "lastModified": "2026-07-21T12:10:00.090", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 3.6, "source": "cve@asrg.io", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "PHYSICAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cve@asrg.io", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49316", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-29T15:26:52.193932Z", "version": "2.0.3"}}]}, "published": "2026-05-29T14:16:32.480", "references": [{"source": "cve@asrg.io", "url": "https://cwe.mitre.org/data/definitions/440.html"}], "sourceIdentifier": "cve@asrg.io", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-440"}, {"lang": "en", "value": "CWE-693"}, {"lang": "en", "value": "CWE-754"}], "source": "cve@asrg.io", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["oem_motorcycle"], "status": "affected", "versions": {"scheme": "generic", "value": "2025"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Scout Bobber + Tech", "source": "cna", "vendor": "Indian Motorcycle (Polaris Inc.)"}, "product": "scout_bobber_+_tech", "vendor": "indian_motorcycle"}], "created": "2026-05-29T15:46:35.814638+00:00", "updated": "2026-05-29T16:00:15.768597+00:00", "vendors": ["indian_motorcycle", "indian_motorcycle$PRODUCT$scout_bobber_+_tech"]}