CVE-2026-1354: CWE-322 in Zero Motorcycles Zero Motorcycles firmware
Zero Motorcycles firmware versions 44 and prior enable an attacker to forcibly pair a device with the motorcycle via Bluetooth. Once paired, an attacker can utilize over-the-air firmware updating functionality to potentially upload malicious firmware to the motorcycle. The motorcycle must first be in Bluetooth pairing mode, and the attacker must be in proximity of the vehicle and understand the full pairing process, to be able to pair their device with the vehicle. The attacker's device must remain paired with and in proximity of the motorcycle for the entire duration of the firmware update.
AI Analysis
Technical Summary
CVE-2026-1354 describes a vulnerability in Zero Motorcycles firmware versions 44 and earlier where an attacker can forcibly pair a device via Bluetooth if the motorcycle is in pairing mode. This unauthorized pairing enables the attacker to leverage the over-the-air firmware update mechanism to upload malicious firmware. The attack requires physical proximity, knowledge of the pairing process, and maintaining the paired connection throughout the update. The vulnerability is classified under CWE-322 (Key Management Errors).
Potential Impact
Successful exploitation can lead to unauthorized firmware installation on the motorcycle, potentially compromising its integrity and functionality. This could result in denial of service or malicious control of the motorcycle's systems. There is no indication of confidentiality impact. The attack complexity is high due to the need for proximity and pairing knowledge.
Mitigation Recommendations
No official patch or remediation is currently available. Users should avoid placing the motorcycle in Bluetooth pairing mode in untrusted environments and restrict physical access to the vehicle. Monitor vendor advisories for updates or patches addressing this vulnerability.
CVE-2026-1354: CWE-322 in Zero Motorcycles Zero Motorcycles firmware
Description
Zero Motorcycles firmware versions 44 and prior enable an attacker to forcibly pair a device with the motorcycle via Bluetooth. Once paired, an attacker can utilize over-the-air firmware updating functionality to potentially upload malicious firmware to the motorcycle. The motorcycle must first be in Bluetooth pairing mode, and the attacker must be in proximity of the vehicle and understand the full pairing process, to be able to pair their device with the vehicle. The attacker's device must remain paired with and in proximity of the motorcycle for the entire duration of the firmware update.
CVSS v3.1
Score 6.4medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-1354 describes a vulnerability in Zero Motorcycles firmware versions 44 and earlier where an attacker can forcibly pair a device via Bluetooth if the motorcycle is in pairing mode. This unauthorized pairing enables the attacker to leverage the over-the-air firmware update mechanism to upload malicious firmware. The attack requires physical proximity, knowledge of the pairing process, and maintaining the paired connection throughout the update. The vulnerability is classified under CWE-322 (Key Management Errors).
Potential Impact
Successful exploitation can lead to unauthorized firmware installation on the motorcycle, potentially compromising its integrity and functionality. This could result in denial of service or malicious control of the motorcycle's systems. There is no indication of confidentiality impact. The attack complexity is high due to the need for proximity and pairing knowledge.
Mitigation Recommendations
No official patch or remediation is currently available. Users should avoid placing the motorcycle in Bluetooth pairing mode in untrusted environments and restrict physical access to the vehicle. Monitor vendor advisories for updates or patches addressing this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- icscert
- Date Reserved
- 2026-01-22T18:31:58.496Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69e7f3aa19fe3cd2cdfdaacf
Added to database: 04/21/2026, 22:01:14 UTC
Last enriched: 07/01/2026, 22:49:17 UTC
Last updated: 07/31/2026, 19:22:57 UTC
Views: 107
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.