CVE-2026-49318

Incorrect behavior order in the Infotainment / Digital Round display of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to bypass the PIN entry screen. The Infotainment uses presence of Wireless Control Module (WCM) traffic during its boot window as a proxy for whether an immobilizer is fitted; if no WCM messages are observed, it skips the PIN entry screen and shows the normal user interface. An attacker who silences the WCM during the boot window — for example via a separately tracked CAN bus-off technique — can present a fully unlocked Infotainment despite the PIN never being entered. Specific timing and protocol details have been withheld pending vendor remediation.

• CWE-636
• CWE-696
• CWE-754

• https://cwe.mitre.org/data/definitions/696.html

Published

May 29, 2026

Last Modified

Jul 21, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49312Permission control vulnerability in the window module. Impac…4
• CVE-2026-49313Permission control vulnerability in the app lock module. Imp…5.5
• CVE-2026-49314OOB write vulnerability in the rendering and composition mod…7.3
• CVE-2026-49315DoS vulnerability in the input device module. Impact: Succes…7.1
• CVE-2026-49316Expected behavior violation in the in-vehicle network of the…4.6
• CVE-2026-49317Incorrect behavior order in the Infotainment / Digital Round…2.4
• CVE-2026-49319Remote Keyless Entry System (RKES), using the 433 MHz key fo…6.9
• CVE-2026-4932IBM PowerVM Hypervisor FW1110.00 through FW1110.20, and FW10…4.2
• CVE-2026-49322Weak authentication in the Wireless Control Module (WCM) of …4.3
• CVE-2026-49323Weak authentication between the Wireless Control Module (WCM…4.3
• CVE-2026-49324Uncontrolled resource consumption in the Wireless Control Mo…4.6
• CVE-2026-49325Improper handling of physical conditions in the bike-shutdow…4.6