Acrisure KARR BT and DR-100

The core failure in the Acrisure KARR BT and DR-100 systems was the use of a single, shared hardcoded Bluetooth authentication key across all deployed devices — a classic insecure-by-design flaw (CWE-321). Because every unit shares the same static credential, any attacker within Bluetooth range can authenticate as a legitimate controller and issue dangerous commands such as unlocking doors or immobilizing engines. This vulnerability is particularly severe given the physical-world consequences and the broad global deployment of dealer-installed units. The incident underscores that embedded and IoT devices must never rely on static, shared secrets, and that firmware security must be validated before mass deployment to consumers.