The Infotainment system in the Indian Motorcycle Scout Bobber + Tech 2025 model determines whether to prompt for a PIN by listening for Wireless Control Module traffic during a boot window. When no such traffic is detected, the system assumes an immobilizer is absent and skips the PIN entry screen, presenting the normal user interface. An attacker in proximity can silence the WCM by inducing a CAN bus-off state, causing the system to bypass the PIN requirement and appear fully unlocked. This flaw allows unauthorized individuals to access the vehicle without the legitimate PIN, effectively compromising vehicle security and potentially enabling further vehicle exploitation.

Indian Motorcycle (Polaris Inc.) Scout Bobber + Tech 2025 infotainment system

The CVSS base score of 1 indicates a low severity level, and the EPSS score is not available. The crash is not listed in the CISA KEV catalog. The exploit requires a local or adjacent network presence, such as a CAN bus attack, and requires the attacker to silence the WCM during system boot. While the risk of exploitation in the wild is considered low, security‐aware users should still treat the flaw with caution because it permits bypass of a fundamental security control.