Which versions of KARR Security System are affected by EUVD-2026-53612?

Vehicles equipped with KARR BT or DR-100 anti-theft systems contain a hardcoded Bluetooth authentication key that permits attackers within wireless range to unlock doors and disable engines without…

How to fix or mitigate EUVD-2026-53612?

Within 24 hours, audit and inventory all vehicles using KARR BT or DR-100 systems, restrict their operation in high-risk environments, and contact the dealer and manufacturer to confirm whether a firmware update or patched hardware revision exists. Within 7 days, implement interim mitigations: relocate affected vehicles to Faraday-cage or RF-shielded parking facilities to disable Bluetooth range, deploy GPS real-time tracking with unauthorized movement alerts, and install secondary physical security controls such as steering wheel locks or engine kill switches. Within 30 days, escalate with manufacturer to obtain a binding timeline for replacement of vulnerable systems with patched anti-theft hardware or alternative security solutions that eliminate reliance on static credentials.

KARR Security System EUVD-2026-53612

Q: What is the CVSS score of EUVD-2026-53612?

EUVD-2026-53612 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-18411 HIGH

Use of Hard-coded Cryptographic Key (CWE-321)

2026-08-05 icscert

GHSA-9288-5j8r-8w68

Authentication Bypass Karr Bt Dr 100

7.2

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

7.2 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Adjacent vector reflects Bluetooth-range-only access; PR:N because hardcoded shared key requires no per-device credential; I:H and A:H for unauthorized vehicle command execution; C:N as no data exfiltration is described.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 21:23 vuln.today

CVE Published

Aug 05, 2026 - 20:13 cve.org

HIGH 7.2

DescriptionCVE.org

The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker within Bluetooth range can leverage this weakness to issue unauthorized commands to the vehicle, potentially allowing unauthorized access to vehicle functions, including door unlocking and engine immobilization.

AnalysisAI

Hardcoded shared Bluetooth authentication key in KARR BT and DR-100 dealer-installed automotive anti-theft systems allows any attacker within Bluetooth range to issue unauthorized commands to affected vehicles without credentials. Exploitation requires only physical proximity and basic Bluetooth tooling, enabling door unlocking and engine immobilization on any unit sharing the static key. No public exploit or CISA KEV listing has been identified at time of analysis, but the hardcoded key class of vulnerability (CWE-321) is well-understood and trivially reversible once discovered.

Technical ContextAI

CWE-321 (Use of Hard-coded Cryptographic Key) is the root cause: both the KARR BT (CPE: cpe:2.3:a:acrisure:karr_bt) and DR-100 (CPE: cpe:2.3:a:acrisure:dr-100) devices, manufactured under the Acrisure brand and dealer-installed as aftermarket automotive anti-theft systems, share a single static Bluetooth authentication key across the entire device fleet. Bluetooth-based vehicle command systems rely on challenge-response or pre-shared key authentication to gate access to privileged vehicle functions. When all units share the same key, any attacker who extracts or reverse-engineers that key from one device gains the ability to authenticate to every other device in the product line. The CVSS 4.0 adjacent-network vector (AV:A) reflects Bluetooth's physical proximity constraint - typically 10 to 100 meters depending on hardware class - rather than internet-wide reachability.

RemediationAI

The vendor-established remediation boundary is versions released on or after July 20, 2026 for both KARR BT and DR-100 product lines. Vehicle owners and fleet operators should contact their Acrisure dealer to confirm whether installed units have received an updated firmware or replacement device incorporating a per-device unique Bluetooth authentication key. The CISA advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-216-01 is the authoritative source for patch guidance. As a compensating control where immediate update is unavailable, operators should restrict physical access to locations where Bluetooth-equipped vehicles are parked, as eliminating proximity eliminates the attack vector. Disabling Bluetooth functionality on the KARR/DR-100 unit - if the dealer interface permits - would fully mitigate the risk at the cost of losing remote command functionality. Fleet operators should treat high-value or sensitive vehicles as highest priority given the engine immobilization capability.