Loading story…
Researchers disclosed a critical flaw in Subaru’s STARLINK connected vehicle platform that allowed takeover of an employee-facing admin portal and unrestricted access to customer accounts in the United States, Canada, and Japan. The attack chain reportedly combined an unauthenticated password-reset endpoint, user enumeration, and a client-side-only two-factor authentication barrier that could be bypassed, enabling attackers to look up drivers using identifiers such as name and ZIP code, email address, phone number, VIN, or a VIN derived from a license plate.
With admin access, an attacker could remotely perform actions including locking or unlocking doors, starting or stopping supported vehicles, adding themselves as an authorized user, and tracking a car’s real-time and historical location data for up to a year. The exposed records also included PII, emergency contacts, billing-related details, vehicle PINs, support history, odometer readings, prior ownership, and sales history; researchers demonstrated unlocking a friend’s Subaru without any user notification. Subaru said it patched the issue within 24 hours of disclosure, and the researchers reported no evidence of malicious exploitation.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers publicly disclosed a critical vulnerability in Subaru's connected vehicle service that exposed customer data and enabled remote vehicle actions in the United States, Canada, and Japan. The disclosure detailed the insecure password reset flow, user enumeration, and bypassable client-side 2FA protections.
After the researchers disclosed the STARLINK Admin Portal vulnerability to Subaru, the company responded and fixed the affected system within 24 hours. The reporting states the issue was not maliciously exploited.
As of 2024-11-20, researchers found Subaru's STARLINK Admin Portal flaws allowed takeover of an employee account, access to customer and vehicle data, and remote actions against vehicles. They demonstrated the impact by adding themselves as an authorized user on a friend's Subaru and remotely unlocking it without notifying the victim.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researcher Dan Hreszczuk of Fortify Labs demonstrated remote access to a BYD Shark 6 through an allegedly unprotected, passwordless entry point. In a controlled test near Canberra, he manipulated door locks, headlights, windscreen wipers and washer, infotainment display, audio volume, and music while the vehicle was being driven; he also tracked its location and activated the cabin microphone. The vehicle’s brakes and cameras were not accessible in the demonstration. The test showed that captured in-cabin voice audio could be used to interact with Siri on an unlocked phone and obtain personal information. The exposure highlights privacy and safety risks in connected vehicles and has renewed attention on Australia’s lack of mandatory automotive cybersecurity standards, while the government consults on potential requirements.
Sep 22, 2026
Researchers at the University of California San Diego disclosed severe flaws in the dealer-installed aftermarket **KARR Security System**, a Bluetooth-enabled alarm and anti-theft device estimated to be present in more than **2 million U.S. vehicles**. The vulnerabilities allow an attacker within Bluetooth range to silently unlock doors, disable alarms, trigger horns and lights, and even block the engine from starting, creating both theft and roadside immobilization risks. The researchers said the issue stems in part from a shared embedded authentication key used across KARR devices, which they extracted by reverse-engineering the official mobile app and validating with a proof-of-concept Android tool. The findings also raised privacy concerns because KARR devices broadcast identifiable Bluetooth signals that could be correlated with public WiGLE data to estimate deployment and potentially infer vehicle movements or frequently visited locations. **Acrisure Protection Group**, which sells the KARR system, released a firmware update after responsible disclosure, but remediation requires owners or dealerships to identify the hardware and manually apply the patch through the KARR smartphone app. Researchers warned that many drivers may not realize the device is installed, because it is often added by dealerships and can remain in vehicles after resale.
Aug 5, 2026
A newly disclosed vulnerability, **CVE-2026-18411**, affects Acrisure **KARR BT** and **DR-100** automotive anti-theft systems by using a shared hard-coded Bluetooth authentication key across devices. The flaw, classified as **CWE-321**, allows an attacker within Bluetooth range to send unauthorized commands without prior privileges or user interaction, creating a direct path to compromise protected vehicle functions. Security reporting and government advisories warn that successful exploitation could let an attacker unlock doors and interfere with engine immobilization on affected vehicles. The issue carries a **CVSS v3.1** score reflecting high integrity and availability impact (`AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H`), and has been referenced by both a **CISA ICS advisory** and a **CERT-PY** notice covering the Bluetooth product vulnerability.
Aug 8, 2026