Search

Zero Motorcycles Firmware Bluetooth Pairing Vulnerability

CISA published ICS Advisory ICSA-26-111-06 disclosing CVE-2026-1354, a medium-severity (CVSS 6.4) Bluetooth pairing vulnerability affecting Zero Motorcycles firmware versions 44 and prior. The flaw, CWE-322 (Key Exchange without Entity Authentication), could allow an attacker in proximity to forcibly pair a device with the motorcycle and potentially upload malicious firmware via over-the-air update functionality. The vendor plans to release a firmware remediation in May 2026.