{"id":"CVE-2026-1354","aliases":["EUVD-2026-24507","GHSA-7f6v-qrqr-m9gm"],"status":"published","title":"Zero Motorcycles Firmware Key Exchange without Entity Authentication","description":"Zero Motorcycles firmware versions 44 and prior enable an attacker to \nforcibly pair a device with the motorcycle via Bluetooth. Once paired, \nan attacker can utilize over-the-air firmware updating functionality to \npotentially upload malicious firmware to the motorcycle. The motorcycle \nmust first be in Bluetooth pairing mode, and the attacker must be in \nproximity of the vehicle and understand the full pairing process, to be \nable to pair their device with the vehicle. The attacker's device must \nremain paired with and in proximity of the motorcycle for the entire \nduration of the firmware update.","severity":{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00134,"percentile":0.02914,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-322"],"published":"2026-04-21T21:43:53Z","modified":"2026-10-26T22:10:00Z","products":[{"vendor":"zero motorcycles","product":"zero motorcycles firmware"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-06"},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-111-06.json"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1354"},{"url":"https://github.com/advisories/GHSA-7f6v-qrqr-m9gm"}],"sources":{"cve":[{"id":"CVE-2026-1354","title":"Zero Motorcycles Firmware Key Exchange without Entity Authentication","description":"Zero Motorcycles firmware versions 44 and prior enable an attacker to \nforcibly pair a device with the motorcycle via Bluetooth. Once paired, \nan attacker can utilize over-the-air firmware updating functionality to \npotentially upload malicious firmware to the motorcycle. The motorcycle \nmust first be in Bluetooth pairing mode, and the attacker must be in \nproximity of the vehicle and understand the full pairing process, to be \nable to pair their device with the vehicle. The attacker's device must \nremain paired with and in proximity of the motorcycle for the entire \nduration of the firmware update.","status":"published","published":"2026-04-21T21:43:53.276Z","modified":"2026-06-24T21:43:06.979Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-322"],"updated_at":"2026-11-02T14:20:01.271368Z"}],"euvd":[{"id":"EUVD-2026-24507","description":"Zero Motorcycles firmware versions 44 and prior enable an attacker to \nforcibly pair a device with the motorcycle via Bluetooth. Once paired, \nan attacker can utilize over-the-air firmware updating functionality to \npotentially upload malicious firmware to the motorcycle. The motorcycle \nmust first be in Bluetooth pairing mode, and the attacker must be in \nproximity of the vehicle and understand the full pairing process, to be \nable to pair their device with the vehicle. The attacker's device must \nremain paired with and in proximity of the motorcycle for the entire \nduration of the firmware update.","status":"published","published":"2026-04-21T21:43:53Z","modified":"2026-06-24T21:43:06Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:20:29.723653Z"}],"ghsa":[{"id":"GHSA-7f6v-qrqr-m9gm","title":"Zero Motorcycles firmware versions 44 and prior enable an attacker to \nforcibly pair a device...","description":"Zero Motorcycles firmware versions 44 and prior enable an attacker to \nforcibly pair a device with the motorcycle via Bluetooth. Once paired, \nan attacker can utilize over-the-air firmware updating functionality to \npotentially upload malicious firmware to the motorcycle. The motorcycle \nmust first be in Bluetooth pairing mode, and the attacker must be in \nproximity of the vehicle and understand the full pairing process, to be \nable to pair their device with the vehicle. The attacker's device must \nremain paired with and in proximity of the motorcycle for the entire \nduration of the firmware update.","status":"published","published":"2026-04-22T00:31:39Z","modified":"2026-04-22T00:31:48Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"medium"}],"cwes":["CWE-322"],"updated_at":"2026-11-02T15:07:34.1405Z"}],"nvd":[{"id":"CVE-2026-1354","description":"Zero Motorcycles firmware versions 44 and prior enable an attacker to \nforcibly pair a device with the motorcycle via Bluetooth. Once paired, \nan attacker can utilize over-the-air firmware updating functionality to \npotentially upload malicious firmware to the motorcycle. The motorcycle \nmust first be in Bluetooth pairing mode, and the attacker must be in \nproximity of the vehicle and understand the full pairing process, to be \nable to pair their device with the vehicle. The attacker's device must \nremain paired with and in proximity of the motorcycle for the entire \nduration of the firmware update.","status":"published","published":"2026-04-21T22:16:18.643Z","modified":"2026-10-26T22:10:00.163Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-322"],"updated_at":"2026-11-02T14:12:15.493943Z"}]}}