Indian Motorcycle Scout Bobber Wireless Control Module Weak Authentication Vulnerability

A weak authentication vulnerability has been identified in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year. This vulnerability allows an adjacent-network attacker with read access to the in-vehicle network to recover the user-set unlock PIN by passively observing a single PIN authentication exchange. The Infotainment Digital Round display responds using a non-cryptographic operation, making the PIN mathematically derivable from one captured exchange. This flaw undermines the motorcycle's primary user-authentication control.

Impact

Exploitation of this vulnerability allows for unauthorized recovery of the user-set unlock PIN, bypassing the motorcycle's authentication controls and potentially leading to unauthorized access or actions within the vehicle's systems.