The fault is in the way the bike’s shutdown circuitry processes a physical signal from the Wireless Control Module (WCM). The WCM normally signals a shutdown by sending a falling‑edge voltage on a dedicated wire pair. The ECU that receives this signal treats a missing pulse the same way it treats an active shutdown pulse, so an open circuit or disconnected cable is interpreted as a legitimate shutdown command. Because no PIN or authentication is checked when the shutdown signal reaches the ECU, a physical attacker can simply cut or disconnect the WCM wiring harness and keep the motorcycle operating, effectively disabling the anti‑theft feature. This flaw constitutes a loss of an integrity‑controlled security function and allows a physically present attacker to steal or tamper with the vehicle. The weakness maps to CWE‑1384 (Faulty Cancellation of an Anti‑Theft Control), CWE‑693 (Improper Management of Key Material), and CWE‑754 (Improper Restriction of Memory Access).

Indian Motorcycle (Polaris Inc.) Scout Bobber + Tech 2025 model year. No other vendors or product variants are listed as affected, and the specific connector details are currently withheld pending vendor remediation.

The CVSS score of 4.1 indicates moderate severity, but the exploitability vector is narrow: an attacker must physically access and disturb the WCM wiring harness. There is no evidence of remote code execution or software‑only attacks; the attack requires direct manipulation of the vehicle’s hardware. Because EPSS data is unavailable and the vulnerability is not catalogued in CISA’s KEV list, the perceived likelihood of widespread exploitation is low. Nonetheless, any entity that could be targeted for theft should treat this flaw as a risk that can be mitigated once the vendor’s fix is applied, especially in environments where the motorcycle is used regularly without frequently cycling the anti‑theft system.