CVE-2026-1354 is a medium-severity vulnerability (CVSS 6.4) in Zero Motorcycles firmware versions 44 and earlier. It involves improper authentication in the Bluetooth pairing process (CWE-322), allowing an attacker to forcibly pair a device with the motorcycle if it is in Bluetooth pairing mode. Once paired, the attacker can leverage the over-the-air firmware update functionality to upload potentially malicious firmware. The attack requires physical proximity, knowledge of the pairing process, and maintaining the connection during the update. There is no vendor advisory or patch available at this time.

Successful exploitation can lead to unauthorized firmware modification, potentially compromising the motorcycle's integrity and functionality. This may result in denial of service or other impacts due to malicious firmware. Confidentiality is not impacted, but integrity and availability are at risk. Exploitation requires physical proximity and user interaction (pairing mode enabled). No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid placing the motorcycle in Bluetooth pairing mode in untrusted environments and restrict physical access to the vehicle to trusted individuals only.