Quick answers
- Is CVE-2026-49317 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-49317 being exploited in the wild.
- How severe is CVE-2026-49317?
- Low severity, with a CVSS score of 2.4, published 29 May 2026.
- Which products and versions are affected?
- Indian Motorcycle Scout Bobber + Tech 2025 model year.
- Is there a fix for CVE-2026-49317?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-49317 attacked?
- It is attacked with physical access.
- Am I affected by CVE-2026-49317?
- Check whether you run Indian Motorcycle Scout Bobber + Tech at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An 'Incorrect Behavior Order' vulnerability exists in the boot sequence of the Indian Motorcycle Infotainment / Digital Round display. The system uses the presence of Wireless Control Module (WCM) traffic on the CAN bus as a proxy to determine if an immobilizer is installed. If an attacker silences WCM messages during the boot window (e.g., via a CAN bus-off attack), the system assumes no immobilizer is present and fails open, skipping the PIN entry requirement. This allows a physical attacker with access to the vehicle's internal network to access the fully unlocked user interface. Specific protocol details are currently withheld pending vendor remediation.
Affected products
- Indian Motorcycle Scout Bobber + Tech 2025 2025 model year
Timeline
- 2026-05-29: disclosed: CVE published to NVD