The flaw arises from an uncontrolled resource consumption in the Wireless Control Module of the Scout Bobber + Tech 2025. An attacker can manipulate the brute‑force lockout counter, which is accessible via unauthenticated in‑vehicle messages, lacks a session binding, and never resets when the motorcycle powers off. By sending a few crafted frames the counter can be tripped, forcing the immobilizer to lock permanently unless dealer service restores it. This exploits weaknesses of access control, inadequate input validation and a lack of resource limits.

Indian Motorcycle (Polaris Inc.) Scout Bobber + Tech 2025 model year vehicles are affected. The vulnerability resides in the vehicle’s WCM firmware and is only present in the 2025 model year series.

The CVSS score of 4.1 indicates a moderate severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. The likely attack vector is an adjacent‑network attacker who can inject write‑capable frames into the in‑vehicle network, which typically requires physical proximity or a compromised nearby device. If such access is achieved, the attacker can easily move the lockout counter and permanently disable the vehicle's starting capability. The absence of a reset on power cycle increases the persistence of the effect, making the exploit a serious operational risk for owners.