The vulnerability involves the infotainment system of the Indian Motorcycle Scout Bobber + Tech 2025 model, which incorrectly relies on detecting WCM traffic during boot to decide whether to prompt for a PIN. An attacker capable of silencing WCM messages during the boot window—potentially via a CAN bus-off technique—can cause the system to skip the PIN entry screen, effectively bypassing this security control. This is classified under CWE-696 (Incorrect Behavior Order). The CVSS 3.1 base score is 2.4, reflecting low severity with local adjacent network attack vector, low complexity, no privileges required, and no user interaction needed. No known exploits are reported in the wild, and no vendor remediation or patch information is currently available.

The impact is limited to confidentiality loss, allowing an attacker on an adjacent network to bypass the PIN entry on the infotainment system. There is no reported impact on integrity or availability. The attacker gains access to the infotainment interface without PIN authentication, which may expose some user interface functions but does not affect vehicle immobilization or engine control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should be aware of the risk of adjacent-network attackers bypassing the PIN entry screen by silencing WCM traffic during boot. No specific vendor-recommended mitigations are currently available.