The vulnerability in the Wireless Control Module (WCM) of the 2025 Indian Motorcycle Scout Bobber + Tech allows an attacker on an adjacent network with write access to the in-vehicle network to cause a permanent immobilization of the motorcycle. This is achieved by exploiting the lockout mechanism of the immobilizer authentication algorithm, which uses a counter that can be incremented by unauthenticated messages without session binding and does not reset on power cycle. By sending a small number of crafted frames, the attacker can trip the lockout, rendering the motorcycle un-startable until dealer intervention. Specific lockout thresholds have not been disclosed pending vendor remediation. The CVSS v3.1 base score is 4.6, reflecting a medium severity with no confidentiality or integrity impact but high availability impact.

The primary impact is a denial of service condition where the motorcycle becomes permanently immobilized until serviced by a dealer. There is no confidentiality or integrity impact reported. The attack requires adjacency to the in-vehicle network and write access, which limits the attack surface but allows an attacker to cause a persistent denial of service by exploiting the lockout counter flaw in the immobilizer authentication mechanism.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been announced. Until a patch is available, affected users should restrict physical and network access to the in-vehicle network to trusted parties only. Dealer service is currently required to reset the lockout condition once triggered.