Cybersecurity Flaws in Electric Motorcycles and Scooters Pose Physical Safety Risks The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued advisories for critical vulnerabilities in electric motorcycles and scooters from Zero Motorcycles and Yadea, which could allow attackers to compromise vehicle safety and security. ### Zero Motorcycles Bluetooth Vulnerability (CVE-2026-1354) Researchers at Bureau Veritas Cybersecurity discovered a medium-severity flaw in Zero Motorcycles’ firmware (version 44 and earlier) that enables unauthorized Bluetooth access. An attacker within range could exploit the pairing process triggered by holding the Mode button or during initial setup to connect a malicious device. Once paired, they could upload malicious firmware, gaining control over safety-critical functions, including: - Throttle and braking behavior - Battery management and thermal safeguards - Cellular modem access (GPS/telemetry repurposing for remote control) While the attack requires proximity and technical expertise, a determined threat actor could manipulate vehicle performance, posing risks at high speeds. Zero Motorcycles plans a firmware patch in May and advises users to pair devices in secure locations. ### Yadea T5 Scooter Authentication Flaw (CVE-2025-70994) A high-severity vulnerability in Yadea’s T5 electric scooter allows attackers to intercept and replay key fob commands, enabling theft. Researcher Ashen Chathuranga demonstrated that an attacker near the scooter can capture a legitimate command (e.g., locking) and synthesize unauthorized unlock/start signals in real time. The flaw stems from weak authentication, requiring no specialized equipment. Yadea has not yet released a patch. Both incidents highlight growing cybersecurity risks in connected vehicles, where software flaws can translate to physical safety threats. The vendors have not responded to requests for comment.