Weak authentication between the Wireless Control Module and the Engine Control Module of the Indian Motorcycle Scout Bobber + Tech 2025 model allows an adjacent‑network attacker who can read the in‑vehicle bus to capture a single seed/key exchange. The WCM uses a reversible, non‑cryptographic operation to generate its response, enabling an attacker to reconstruct the persistent immobilizer secret from one captured message and then manually authenticate to the ECM, thereby starting the engine and bypassing the immobilizer.

The vulnerability affects the 2025 Scout Bobber + Tech produced by Indian Motorcycle, a subsidiary of Polaris Inc. It involves the Wireless Control Module and the Engine Control Module that communicate over the vehicle’s internal network.

The CVSS score of 4.1 indicates moderate severity. No EPSS score is available and the vulnerability is not included in CISA’s KEV catalog. The likely attack vector is an attacker with read access to the vehicle’s internal network, which is typically possible when the vehicle is in proximity to other vehicles or infrastructure that can tap the bus. With such access the attacker can passively observe a single exchange and recover the immobilizer secret, after which they can impersonate the legitimate control module and start the engine.