One Bluetooth Key Unlocks All Acrisure KARR, DR-100 Vehicles
A shared hard-coded authentication key across every deployed unit means proximity is the only access control left, and that's not control at all.
TL;DR
CISA disclosed CVE-2026-18411 on Wednesday: a hard-coded Bluetooth authentication key shared across all Acrisure KARR BT and DR-100 dealer-installed anti-theft systems. Extract the key from one unit and you have it for every unit. An attacker within Bluetooth range can unlock doors, disable engines, and issue unauthorized commands. Acrisure released a firmware fix July 20. The advisory is the public notification, not the patch, fleet operators should already be deploying. CVSS 8.1, adjacency-only attack vector, no privileges required, and the shared key means the attack scales to every unpatched vehicle.
The vulnerability is CWE-321 (Use of Hard-coded Cryptographic Key) and it's as straightforward as it sounds. The UC San Diego research team that reported it to CISA found that Acrisure's KARR BT and DR-100 systems use the same Bluetooth authentication key on all deployed devices. No key derivation, no per-unit diversity, no defense against an attacker who extracts the key once and applies it everywhere.
For fleet operators, this creates an asymmetric exposure window. A firmware patch shipped July 20, but fleet vehicles don't get patched the way servers do. Every unit that hasn't received the update is trivially accessible to anyone who's obtained the shared key and is within Bluetooth range, a parking lot, a depot, a motor pool. The CVSS v3.1 score of 8.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) reflects exactly this: adjacency-only attack vector, no privileges, no user interaction, high integrity and availability impact.
Acrisure has published update instructions at karrsecurity.com. CISA's recommended mitigations are the standard ICS defensive measures (network segmentation, VPNs, firewall isolation) none of which apply to a Bluetooth subsystem on a vehicle. The only remediation is firmware deployment. The only question is how fast.
Published ·Deep Fathom