Indian Scout 2025: WCM voltage-based shutdown bypassable via wiring interruption

Improper handling of physical conditions in the bike-shutdown control of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows a physical attacker with access to the Wireless Control Module (WCM) wiring harness to bypass the anti-theft shutdown. The WCM signals shutdown to a peer ECU via a falling-edge voltage transition on a dedicated wire pair. The receiving ECU does not distinguish between an active shutdown pulse and an open-circuit / disconnected condition; interrupting the relevant wires leaves the motorcycle fully operable even though the WCM never validated the rider's PIN.

Specific connector details have been withheld pending vendor remediation.

Recommended remediation:

Use a positive-validation heartbeat: the receiving ECU should require a periodic rising-edge or signed message from the WCM and treat its absence as the shutdown command (fail-secure). Combine with CAN-A liveness validation. Add tamper-evident sealing on the WCM connector.

Scott Sheahan, Rustic Security LLC (finder)

2025-03-26: Reported to Indian Motorcycle (Polaris Inc.) by Rustic Security LLC under responsible disclosure

2026-05-29: Public disclosure by ASRG