An issue in Hero Motocorp Vida V1 Pro firmware 2.0.7 allows a local attacker to trigger a denial of service by exploiting the BLE component. The flaw leads to resource exhaustion or a crash that renders the device inoperable, preventing normal operation until it is reset or re‑started. The weakness is a classic input/resource exhaustion problem, identified as CWE-400.

The vulnerability affects Hero Motocorp’s Vida V1 Pro single‑seat electric motorcycle running firmware version 2.0.7. No additional products or versions are listed, so the impact is limited to units identified with that specific firmware revision.

The CVSS score of 7.5 indicates a high severity, but the EPSS score of less than 1% suggests a very low probability of widespread exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local, requiring proximity to the motorcycle and the ability to initiate unauthenticated BLE connections. An attacker could exploit the flaw by sending crafted BLE packets that cause the device to freeze or crash, forcing a denial of service.