CVE-2026-49322 describes a weak authentication vulnerability in the Wireless Control Module of the 2025 Indian Motorcycle Scout Bobber + Tech. The issue stems from the use of a non-cryptographic challenge-response mechanism in the Infotainment Digital Round display, which allows an attacker with passive read access to the in-vehicle network to mathematically derive the user-set unlock PIN from a single captured authentication exchange. This defeats the motorcycle's primary user authentication control. Specific protocol details are withheld pending vendor remediation. No patch or official fix has been disclosed as of the publication date.

An attacker with adjacent-network access and the ability to passively observe the in-vehicle network can recover the user unlock PIN, potentially allowing unauthorized unlocking of the motorcycle. The vulnerability compromises confidentiality of the PIN but does not affect integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit physical or network adjacency access to the motorcycle's in-vehicle network to trusted parties only. Monitor for vendor updates regarding official patches or mitigations.