Indian Scout 2025: Immobilizer state machine desynchronization denies engine start

Incorrect behavior order in the immobilizer authentication state machine between the Wireless Control Module (WCM) and the Engine Control Module (ECM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker to permanently deny engine start. The state machine does not bind seed and key exchanges to a session, so an unsolicited mid-authentication request from an attacker can desynchronize the WCM's response from the ECM's expected challenge. The mismatched key is rejected, the ECM stays locked, and the engine never starts.

Specific protocol details have been withheld pending vendor remediation.

Recommended remediation:

Bind the seed/key exchange to a session identifier; have the WCM re-derive its key when it observes a new seed from the ECM, and have the ECM accept seed-request frames only from an authenticated WCM source via AUTOSAR SecOC or equivalent.

Scott Sheahan, Rustic Security LLC (finder)

2025-03-26: Reported to Indian Motorcycle (Polaris Inc.) by Rustic Security LLC under responsible disclosure

2026-05-29: Public disclosure by ASRG