The vulnerability in Zero Motorcycles firmware versions 44 and earlier permits an attacker to forcibly pair a device with the motorcycle over Bluetooth if the motorcycle is in pairing mode. Once paired, the attacker can leverage the over-the-air firmware update functionality to upload potentially malicious firmware. Successful exploitation requires physical proximity, knowledge of the pairing process, and maintaining the paired connection during the update. This issue is classified under CWE-322, which relates to improper or missing cryptographic controls.

An attacker who successfully pairs with the motorcycle via Bluetooth can upload malicious firmware, potentially compromising the motorcycle's integrity and availability. This could lead to unauthorized control or disruption of the motorcycle's functions. The attack requires user interaction (motorcycle in pairing mode) and physical proximity, limiting remote exploitation. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid placing the motorcycle in Bluetooth pairing mode in untrusted environments and restrict physical access to the vehicle during pairing. Monitor official Zero Motorcycles communications for firmware updates addressing this vulnerability.