Hard-Coded Bluetooth Key Exposes Acrisure KARR BT and DR-100 to Vehicle Takeover
Vulnerability Disclosure · 2 sources · Updated 3mo ago · First seen Aug 5, 2026
A newly disclosed vulnerability, CVE-2026-18411, affects Acrisure KARR BT and DR-100 automotive anti-theft systems by using a shared hard-coded Bluetooth authentication key across devices. The flaw, classified as CWE-321, allows an attacker within Bluetooth range to send unauthorized commands without prior privileges or user interaction, creating a direct path to compromise protected vehicle functions.
Security reporting and government advisories warn that successful exploitation could let an attacker unlock doors and interfere with engine immobilization on affected vehicles. The issue carries a CVSS v3.1 score reflecting high integrity and availability impact (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), and has been referenced by both a CISA ICS advisory and a CERT-PY notice covering the Bluetooth product vulnerability.
