This vulnerability arises from an incorrect behavior order in the infotainment system of the Indian Motorcycle Scout Bobber + Tech 2025 model. The system relies on detecting WCM traffic during boot to determine if an immobilizer is installed. If no WCM messages are detected, the system bypasses the PIN entry screen and grants access to the infotainment interface. An attacker capable of silencing WCM traffic during the boot window, for example via a CAN bus-off technique, can exploit this logic flaw to bypass PIN authentication. Specific timing and protocol details have not been disclosed pending vendor remediation. No official patch or remediation guidance is currently available.

The vulnerability allows an adjacent-network attacker to bypass the PIN entry screen on the infotainment system, potentially granting unauthorized access to the infotainment interface. The confidentiality impact is low, as indicated by the CVSS score, and there is no impact on integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be aware of the potential for PIN bypass via manipulation of WCM traffic during boot. No official mitigation or workaround has been provided by the vendor.