Loading vulnerability…
Shared Bluetooth Authentication Key in KARR Security System and SWDS Anti-Theft Systems
CVE-2026-18411 is a vulnerability in dealer-installed KARR Security System and SWDS automotive anti-theft systems, including Acrisure KARR BT and DR-100 versions prior to July 20, 2026. The affected devices use a shared Bluetooth authentication key across impacted units rather than a unique per-device key. Because Bluetooth authentication relies on a common key, an attacker in Bluetooth proximity can authenticate to the system and issue unauthorized commands to the connected vehicle. Reported impacts include unauthorized activation of vehicle functions such as door unlocking and engine immobilization. The issue is classified as CWE-321.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an adjacent attacker to send unauthorized control commands to affected vehicle anti-theft systems. This can compromise the integrity and availability of vehicle functions by enabling unauthorized door unlocking and triggering engine immobilization. The vulnerability does not indicate direct confidentiality impact, but it can enable unauthorized physical access to the vehicle and operational disruption.
If you can’t patch tonight, do this now.
Until patches are applied, reduce Bluetooth exposure by limiting attacker proximity opportunities and disabling or restricting use of the vulnerable Bluetooth functionality where operationally feasible. Vehicles using affected dealer-installed anti-theft systems should be parked in controlled-access areas when possible, and owners should consult installers or dealerships for temporary configuration changes or feature disablement that prevent Bluetooth-based command acceptance. Replacement of affected hardware may be necessary if no firmware fix is available.
Patch, then assume compromise.
Apply manufacturer-issued firmware updates for affected KARR Security System and SWDS devices where available. Affected organizations and vehicle owners should contact the dealership or local installer/provider to determine patch availability for Acrisure KARR BT and DR-100 systems, particularly for versions prior to July 20, 2026. Devices should be updated to a release that replaces the shared Bluetooth authentication model with a unique per-device credentialing mechanism.
No public exploits tracked yet. Mallory keeps watching.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.