CVE-2026-18411
Use of hard-coded cryptographic key in Acrisure KARR BT and DR-100
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker within Bluetooth range can leverage this weakness to issue unauthorized commands to the vehicle, potentially allowing unauthorized access to vehicle functions, including door unlocking and engine immobilization.
| CWE | CWE-321 |
| Vendor | acrisure |
| Product | karr bt |
| Published | Aug 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for acrisure karr bt
Be the first to know when new high vulnerabilities affecting acrisure karr bt are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High
Affected Versions
Acrisure / KARR BT
Versions prior to July 20, 2026
Acrisure / DR-100
Versions prior to July 20, 2026
References
Credits
Aaron Schulman, Jerry Yu, Yibo Wei, Sumanth Rao, Mohak Vaswani, Jefferson Chien, Christian Dameff, and Nishant Bhaskar of UC San Diego team discovered this vulnerability.