CISA 2026-08-04

Acrisure KARR BT and DR-100

CVE-2026-18411

Machine-generated analysis · WAYSCloud LLM

Devices with firmware older than July 20 2026 use a shared hard-coded Bluetooth key, enabling nearby attackers to issue unauthorized vehicle commands.

Context

The advisory concerns Acrisure KARR BT and DR-100 automotive anti-theft units.
Firmware versions earlier than July 20 2026 contain a hard-coded Bluetooth authentication key that allows an attacker within range to unlock doors or immobilize the engine.
The vendor released a firmware update on July 20 2026 to replace the key.
The products are deployed worldwide in transportation systems.

Operator considerations

Check: verify firmware version is earlier than July 20 2026.
Patch: apply the July 20 2026 firmware update from the vendor.
Isolate: restrict Bluetooth connectivity of the devices until patched.
Log: monitor Bluetooth authentication attempts for unexpected commands.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of this vulnerability could allow an attacker to perform unauthorized vehicle control operations.

The following versions of Acrisure KARR BT and DR-100 are affected:

KARR BT firmware

Read the full advisory on CISA →