This vulnerability arises from weak authentication in the communication between the WCM and ECM of the Indian Motorcycle Scout Bobber + Tech 2025 model. The WCM uses a reversible, non-cryptographic operation to derive its response during the seed/key exchange, enabling an attacker who can passively observe this exchange on the in-vehicle network to reconstruct the persistent immobilizer secret. With this secret, the attacker can impersonate the WCM to the ECM and start the engine without authorization. Specific protocol details have been withheld pending vendor remediation. The CVSS v3.1 base score is 4.3, reflecting a medium severity with attack vector as adjacent network, low attack complexity, no privileges required, and user interaction required. Confidentiality impact is high, while integrity and availability impacts are none.

The vulnerability allows an attacker with adjacent network access and read privileges on the in-vehicle network to recover the immobilizer secret, enabling unauthorized engine start and defeating the immobilizer security. This compromises vehicle theft protection but does not impact data integrity or availability of the vehicle systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published at this time. Until a vendor patch is available, limiting physical or wireless access to the in-vehicle network and monitoring for unauthorized access attempts may reduce risk.