Vulnerability · Published Apr 21, 2026 · Assigned by icscert
CVE-2026-1354Zero Motorcycles Firmware Key Exchange without Entity Authentication
Medium 6.4
In plain English
A medium-severity security flaw in Zero Motorcycles firmware from Zero Motorcycles. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Official description
Zero Motorcycles firmware versions 44 and prior enable an attacker to forcibly pair a device with the motorcycle via Bluetooth. Once paired, an attacker can utilize over-the-air firmware updating functionality to potentially upload malicious firmware to the motorcycle. The motorcycle must first be in Bluetooth pairing mode, and the attacker must be in proximity of the vehicle and understand the full pairing process, to be able to pair their device with the vehicle. The attacker's device must remain paired with and in proximity of the motorcycle for the entire duration of the firmware update.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Zero Motorcycles | Zero Motorcycles firmware | 0 – through 44 |
Weakness: CWE-322 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H