CVE-2026-49322: Indian Motorcycle Scout Bobber + Tech, слаба

Описание

Оригинално описание

Weak authentication in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with read access to the in-vehicle network to recover the user-set unlock PIN by passively observing a single PIN authentication exchange. The Infotainment Digital Round display computes its response using a non-cryptographic operation rather than a cryptographic challenge-response, so the PIN is mathematically derivable from one captured exchange, defeating the motorcycle's primary user-authentication control. Specific protocol details have been withheld pending vendor remediation.

Засегнати продукти

• Indian Motorcycle Scout Bobber + Tech: 2025

Вид слабост

• CWE-1390 Weak Authentication
• CWE-327 Използване на компрометиран или рисков криптографски алгоритъм
• CWE-294 Заобикаляне на автентикация чрез преизпълнение

История

Други уязвимости в Indian Motorcycle Scout Bobber + Tech

• 2.4CVE-2026-49318
• 2.4CVE-2026-49317
• 4.6CVE-2026-49316
• 4.6CVE-2026-49325
• 4.6CVE-2026-49324

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-49322
• https://nvd.nist.gov/vuln/detail/CVE-2026-49322
• https://www.asrg.io/security-advisories/cve-2026-49322-indian-scout-infotainment-wcm-weak-authentication