Weak authentication in the Wireless Control Module of the Indian Motorcycle Scout Bobber + Tech 2025 model allows an attacker on an adjacent network, with read access to the in‑vehicle network, to recover the user‑set unlock PIN by passively observing a single authentication exchange. The infotainment system uses a non‑cryptographic operation to compute its response, making the PIN mathematically derivable, which undermines the motorcycle’s primary user‑authentication control and permits an attacker to unlock the vehicle without the user’s knowledge.

The vulnerability affects Indian Motorcycle vehicles, specifically the Scout Bobber + Tech 2025 model year, where the infotainment digital round display communicates with the Wireless Control Module. No other products or older model years are listed, and the manufacturer identifies only the 2025 model as impacted.

The CVSS score of 4.1 indicates moderate severity; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack does not require advanced skills or credentials beyond proximity and the ability to read the local in‑vehicle network traffic. The exploit is passive, relying on a single captured exchange, and therefore is relatively easy to execute for an attacker within range.