View CSAF

Summary

Successful exploitation of this vulnerability could allow an attacker to pair via Bluetooth with a motorcycle, gaining unauthorized access to all Bluetooth functions, including changing the firmware.

The following versions of Zero Motorcycles Firmware (Update A) are affected:

Zero Motorcycles firmware <=44 (CVE-2026-1354)

CVSS Vendor Equipment Vulnerabilities

v3 6.4 Zero Motorcycles Zero Motorcycles Firmware (Update A) Key Exchange without Entity Authentication

Background

Critical Infrastructure Sectors: Transportation Systems

Countries/Areas Deployed: Worldwide

Company Headquarters Location: United States

Vulnerabilities

Expand All +

CVE-2026-1354

Zero Motorcycles firmware versions 44 and prior enable an attacker to forcibly pair a device with the motorcycle via Bluetooth. Once paired, an attacker can utilize over-the-air firmware updating functionality to potentially upload malicious firmware to the motorcycle.…