Acrisure KARR BT and DR-100

CISA published an ICS advisory for Acrisure KARR BT and DR-100 automotive anti-theft systems, disclosing a critical vulnerability (CVE-2026-18411) involving the use of a shared hard-coded Bluetooth authentication key across affected devices. An attacker within Bluetooth range can exploit this weakness to issue unauthorized commands to vehicles, enabling unauthorized door unlocking or engine immobilization. The vulnerability affects KARR BT and DR-100 firmware versions prior to July 20, 2026, and is classified as HIGH severity with a CVSS v3.1 score of 8.1. Acrisure Protection Group released a firmware patch on July 20, 2026, to remediate the issue. Affected systems fall under the Transportation Systems critical infrastructure sector and are deployed worldwide. The vulnerability was discovered and reported by a research team from UC San Diego. No known public exploitation has been reported at the time of publication. Users are advised to apply the firmware update and follow vendor instructions at karrsecurity.com.