# CVE-2026-49317: Indian Motorcycle Scout Bobber Infotainment PIN bypass

Source: https://junglewise.ai/threats/cve-2026-49317-indian-motorcycle-scout-bobber-infotainment-pin-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-49317 · Severity: low · CVSS 2.4 · Published 2026-05-29

A security flaw in the infotainment system of the 2025 Indian Motorcycle Scout Bobber + Tech allows an unauthorized person to bypass the PIN security screen. By interfering with the vehicle's internal communication during startup, an attacker can gain full access to the digital display and its functions without knowing the owner's PIN. This could lead to unauthorized access to user settings and vehicle information.

Technologies: [Indian Motorcycle Scout Bobber + Tech](https://junglewise.ai/threats/technologies/scout-bobber-tech). Vendors: [Indian Motorcycle](https://junglewise.ai/threats/vendors/indian-motorcycle).

## Quick answers

**Is CVE-2026-49317 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49317 being exploited in the wild.

**How severe is CVE-2026-49317?** Low severity, with a CVSS score of 2.4, published 29 May 2026.

**Which products and versions are affected?** Indian Motorcycle Scout Bobber + Tech 2025 model year.

**Is there a fix for CVE-2026-49317?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-49317 attacked?** It is attacked with physical access.

**Am I affected by CVE-2026-49317?** Check whether you run Indian Motorcycle Scout Bobber + Tech at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An 'Incorrect Behavior Order' vulnerability exists in the boot sequence of the Indian Motorcycle Infotainment / Digital Round display. The system uses the presence of Wireless Control Module (WCM) traffic on the CAN bus as a proxy to determine if an immobilizer is installed. If an attacker silences WCM messages during the boot window (e.g., via a CAN bus-off attack), the system assumes no immobilizer is present and fails open, skipping the PIN entry requirement. This allows a physical attacker with access to the vehicle's internal network to access the fully unlocked user interface. Specific protocol details are currently withheld pending vendor remediation.

## Affected products

- Indian Motorcycle Scout Bobber + Tech 2025 2025 model year

## Timeline

- 2026-05-29: disclosed: CVE published to NVD

## References

- [https://cwe.mitre.org/data/definitions/696.html](https://cwe.mitre.org/data/definitions/696.html)

## Related threats

- [Indian Motorcycle Scout Bobber anti-theft bypass in WCM wiring](https://junglewise.ai/threats/cve-2026-49325-indian-motorcycle-scout-bobber-anti-theft-bypass-in-wcm-wiring)
- [Indian Motorcycle Scout Bobber resource consumption in WCM](https://junglewise.ai/threats/cve-2026-49324-indian-motorcycle-scout-bobber-resource-consumption-in-wcm)
- [Indian Motorcycle Scout Bobber weak authentication in ECM immobilizer](https://junglewise.ai/threats/cve-2026-49323-indian-motorcycle-scout-bobber-weak-authentication-in-ecm)
- [Indian Motorcycle Scout Bobber weak authentication in WCM](https://junglewise.ai/threats/cve-2026-49322-indian-motorcycle-scout-bobber-weak-authentication-in-wcm)