CVE-2026-49324 describes an uncontrolled resource consumption vulnerability (CWE-400) in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model. The WCM implements a brute-force lockout mechanism on the immobilizer authentication algorithm, but the lockout counter is accessible via any unauthenticated message on the in-vehicle network, lacks session binding, and persists across power cycles. An attacker with write access to the adjacent in-vehicle network can deliberately trigger this lockout by sending a small number of crafted frames, permanently preventing the motorcycle from starting until dealer service resets the lockout. Specific lockout thresholds have not been disclosed pending vendor remediation. No patch or official fix has been announced as of the publication date.

The vulnerability allows an attacker with write access to the adjacent in-vehicle network to cause a denial of service by permanently immobilizing the motorcycle. This results in an availability impact (denial of service) without compromising confidentiality or integrity. The motorcycle remains un-startable until a dealer resets the lockout, potentially causing inconvenience and requiring physical service intervention.

No official patch or remediation is currently available. Since the lockout counter does not reset on power cycle and can be triggered by unauthenticated messages, affected users should avoid exposing the in-vehicle network to unauthorized write access. Dealer service is required to reset the lockout once triggered. Monitor vendor advisories for updates on patches or official mitigations.