This vulnerability arises from the WCM in the Indian Motorcycle Scout Bobber + Tech 2025 model being susceptible to a CAN error-frame injection attack. By exploiting a well-known technique, an attacker can drive the WCM's CAN controller transmit error counter beyond the bus-off threshold, causing it to cease all message transmissions, including critical anti-theft shutdown commands. Because other ECUs do not recognize the WCM's silence as a fault or security event, the motorcycle continues normal operation, effectively bypassing the immobilizer. The vulnerability is classified under CWE-440 (Expected Behavior Violation). No patch or remediation level has been disclosed by the vendor at this time.

The vulnerability allows an attacker with adjacent network access to bypass the motorcycle's anti-theft shutdown mechanism by disabling the WCM's communication on the CAN bus. This results in the motorcycle being operable without unlocking the immobilizer, potentially enabling unauthorized use. The CVSS score of 4.6 reflects a medium severity with no confidentiality or integrity impact but a high availability impact due to denial of WCM functionality. There are no known exploits in the wild currently.

No official patch or remediation guidance has been provided by the vendor as of the publication date. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limiting physical or network adjacency access to the motorcycle's CAN bus may reduce exposure. Monitor vendor communications for updates on patches or mitigations.