CISA warns of Bluetooth flaw in Acrisure KARR BT and DR-100 systems

CISA said a Bluetooth authentication flaw in Acrisure KARR BT and DR-100 anti-theft systems could let an attacker within range send unauthorized vehicle commands.

CISA published an advisory on Aug. 4 about CVE-2026-18411, a high-severity flaw affecting Acrisure KARR BT and DR-100 products. The agency said the issue could allow unauthorized access to vehicle functions, including door unlocking and engine immobilization, if an attacker is within Bluetooth range.

CISA said the flaw affects firmware versions earlier than July 20, 2026, and stems from the use of a shared Bluetooth authentication key across affected devices.

The agency rated the flaw 8.1 under CVSS v3.1, with the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. It also rated the issue 7.2 under CVSS v4.0, with the vector CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N. CISA classified the weakness as CWE-321, use of a hard-coded cryptographic key.

According to the advisory, Acrisure Protection Group released a firmware update on July 20, 2026. CISA directed affected users to firmware update instructions at karrsecurity.com. The agency said the vendor is Acrisure, the product status is listed as known affected, and the deployment is worldwide.

CISA said no known public exploitation specifically targeting this vulnerability had been reported to the agency at the time of publication. The advisory also said the vulnerability was reported to CISA by a UC San Diego team that included Aaron Schulman, Jerry Yu, Yibo Wei, Sumanth Rao, Mohak Vaswani, Jefferson Chien, Christian Dameff and Nishant Bhaskar.

Users can find update guidance at karrsecurity.com.

Sources

• CISA Cybersecurity Advisories
• KARR Security firmware update instructions

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.