[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fkYKWeqDa_L3ujPR1BcowKMHgFin0rT330bmFKFl6Yzw":3},{"article":4,"iocs":48,"watch_terms":57,"solutions":58,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":32},"91f66e88-91f6-489c-9bda-4d509665ebf1","Acrisure KARR BT and DR-100","acrisure-karr-bt-and-dr-100-8f6673","View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to perform unauthorized vehicle control operations. The following versions of Acrisure KARR BT and DR-100 are affected: KARR BT firmware \u003CJuly_20_2026 DR-100 firmware \u003CJuly_20_2026 CVSS Vendor Equipment Vulnerabilities v3 8.1 Acrisure Acrisure KARR BT and DR-100 Use of Hard-coded Cryptographic Key Background Critical Infrastructure Sectors: Transportation Systems Countries\u002FAreas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2026-18411 The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker within Bluetooth range can leverage this weakness to issue unauthorized commands to the vehicle, potentially allowing unauthorized access to vehicle functions, including door unlocking and engine immobilization. View CVE Details Affected Products Acrisure KARR BT and DR-100 Vendor: Acrisure Product Version: Acrisure KARR BT firmware: \u003CJuly_20_2026, Acrisure DR-100 firmware: \u003CJuly_20_2026 Product Status: known_affected Remediations Vendor fix Acrisure Protection Group released a firmware update on July 20, 2026, to address this vulnerability. They recommend that affected users should follow the directions found here: https:\u002F\u002Fwww.karrsecurity.com\u002Fkarr-security-firmware-update-instructions. https:\u002F\u002Fwww.karrsecurity.com\u002Fkarr-security-firmware-update-instructions Relevant CWE: CWE-321 Use of Hard-coded Cryptographic Key Metrics CVSS Version Base Score Base Severity Vector String 3.1 8.1 HIGH CVSS:3.1\u002FAV:A\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H 4.0 7.2 HIGH CVSS:4.0\u002FAV:A\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N Acknowledgments Aaron Schulman, Jerry Yu, Yibo Wei, Sumanth Rao, Mohak Vaswani, Jefferson Chien, Christian Dameff, Nishant Bhaskar of UC San Diego team reported this vulnerability to CISA. Legal Notice and Terms of Use This product is provided subject to this Notification (https:\u002F\u002Fwww.cisa.gov\u002Fnotification) and this Privacy & Use policy (https:\u002F\u002Fwww.cisa.gov\u002Fprivacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for all control system devices and\u002For systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov\u002Fics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov\u002Fics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. Revision History Initial Release Date: 2026-08-04 Date Revision Summary 2026-08-04 1 Initial Publication Legal Notice and Terms of Use","CISA disclosed CVE-2026-18411 in Acrisure KARR BT and DR-100 automotive anti-theft systems, affecting dealer-installed vehicle security devices worldwide. The vulnerability stems from a shared hardcoded Bluetooth authentication key (CWE-321) that allows attackers within Bluetooth range to issue unauthorized commands, including door unlocking and engine immobilization. Acrisure released a firmware patch on July 20, 2026, and CISA recommends immediate updates and network isolation measures.","Acrisure KARR BT and DR-100 vehicle security systems vulnerable to unauthorized control via hardcoded Bluetooth key.","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-216-01",null,"2026-08-04T12:00:00+00:00","2026-08-04T16:00:05.832773+00:00",8,[17,20,23,25],{"name":18,"type":19},"Acrisure","vendor",{"name":21,"type":22},"KARR BT","product",{"name":24,"type":22},"DR-100",{"name":26,"type":27},"Bluetooth","technology","d6f63bb8-0801-486a-be7f-171400700454",{"id":28,"icon":12,"name":30,"slug":31},"IoT\u002FOT","iot-ot",[33,38,43],{"category":34},{"id":35,"icon":12,"name":36,"slug":37},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":39},{"id":40,"icon":12,"name":41,"slug":42},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":44},{"id":45,"icon":12,"name":46,"slug":47},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[49,53],{"type":50,"value":51,"context":52},"cve","CVE-2026-18411","Hardcoded cryptographic key in Acrisure KARR BT and DR-100 allows unauthorized vehicle control via Bluetooth",{"type":54,"value":55,"context":56},"url","https:\u002F\u002Fwww.karrsecurity.com\u002Fkarr-security-firmware-update-instructions","Official firmware update instructions for affected Acrisure security systems",[18,21,24],{"controls":59,"vendors":146},[60,88,117],{"slug":61,"name":62,"problem":63,"products":64},"patch-management","Automated patch management","Known holes get closed in days, not months.",[65,73,80],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":61,"product_name":77,"url":78,"description":79},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":89,"name":90,"problem":91,"products":92},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"slug":118,"name":119,"problem":120,"products":121},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-ot-security","Tenable OT Security","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fot-security","Asset inventory, vulnerability and threat detection for industrial networks.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"dragos","Dragos","\u002Fvendor-logos\u002Fdragos.png","dragos-platform","Dragos Platform","https:\u002F\u002Fwww.dragos.com\u002Fcybersecurity-platform\u002F","OT asset visibility, threat detection and response guidance for industrial environments.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"claroty","Claroty","\u002Fvendor-logos\u002Fclaroty.png","xdome","Claroty xDome","https:\u002F\u002Fclaroty.com\u002Findustrial-cybersecurity\u002Fxdome","Asset inventory, vulnerability management and threat detection for industrial networks.",[],{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":163},"hardcoded-bluetooth-key-exposes-automotive-anti-theft-systems-to-remote-attack","Hardcoded Bluetooth Key Exposes Automotive Anti-Theft Systems to Remote Attack","The core failure in the Acrisure KARR BT and DR-100 systems was the use of a single, shared hardcoded Bluetooth authentication key across all deployed devices — a classic insecure-by-design flaw (CWE-321). Because every unit shares the same static credential, any attacker within Bluetooth range can authenticate as a legitimate controller and issue dangerous commands such as unlocking doors or immobilizing engines. This vulnerability is particularly severe given the physical-world consequences and the broad global deployment of dealer-installed units. The incident underscores that embedded and IoT devices must never rely on static, shared secrets, and that firmware security must be validated before mass deployment to consumers.",[152,153,154,155,156,157,158,159,160,161,162],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 7: Continuous Vulnerability Management","CIS Control 16: Application Software Security","NIST SP 800-53 IA-5: Authenticator Management (prohibiting hardcoded credentials)","NIST SP 800-53 SA-3: System Development Life Cycle (secure design)","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-193: Platform Firmware Resiliency Guidelines","CWE-321: Use of Hard-coded Cryptographic Key","ETSI EN 303 645: Cybersecurity for Consumer IoT (Clause 5.1 — no universal default passwords)","IEC 62443-4-2: Security for Industrial Automation and Control Systems — Component Requirements","NIST CSF 2.0 PR.AA-01: Identity and Credential Management",{}]