Indian Scout Bobber 2025 WCM CAN bus-off attack silently bypasses anti-theft shutdown
Expected behavior violation in the in-vehicle network of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypass the motorcycle's anti-theft shutdown by forcing the Wireless Control Module (WCM) into the CAN bus-off state. Using a well-known CAN error-frame injection technique against a periodic WCM transmission, the attacker drives the WCM CAN controller's transmit error counter past the bus-off threshold, after which the WCM stops transmitting all messages, including the shutdown command. Peer ECUs do not interpret WCM silence as a security event and continue normal operation, allowing the motorcycle to be operated despite the immobilizer never having been unlocked. Specific protocol details have been withheld pending vendor remediation.
Problem Types
| Type | CWE ID | Description |
|---|
| CWE | CWE-440 | CWE-440 Expected Behavior Violation |
| CWE | CWE-754 | CWE-754 Improper Check for Unusual or Exceptional Conditions |
| CWE | CWE-693 | CWE-693 Protection Mechanism Failure |
Type: CWE
Description: CWE-440 Expected Behavior Violation
Type: CWE
Description: CWE-754 Improper Check for Unusual or Exceptional Conditions
Type: CWE
Description: CWE-693 Protection Mechanism Failure
Metrics
| Version | Base score | Base severity | Vector |
|---|
| 3.1 | 4.6 | MEDIUM | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 4.0 | 4.1 | MEDIUM | CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Version: 3.1
Base score: 4.6
Base severity: MEDIUM
Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Version: 4.0
Base score: 4.1
Base severity: MEDIUM
Vector: CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Impacts
| CAPEC ID | Description |
|---|
| N/A | Obstruction |
| N/A | Software Integrity Attack |
CAPEC ID: N/A
Description: Obstruction
CAPEC ID: N/A
Description: Software Integrity Attack
Timeline
| Event | Date |
|---|
| Reported to Indian Motorcycle by Rustic Security LLC (responsible disclosure) | 2025-03-26 00:00:00 |
Event: Reported to Indian Motorcycle by Rustic Security LLC (responsible disclosure)
Date: 2025-03-26 00:00:00