Dr 100
Monthly
Hardcoded shared Bluetooth authentication key in KARR BT and DR-100 dealer-installed automotive anti-theft systems allows any attacker within Bluetooth range to issue unauthorized commands to affected vehicles without credentials. Exploitation requires only physical proximity and basic Bluetooth tooling, enabling door unlocking and engine immobilization on any unit sharing the static key. No public exploit or CISA KEV listing has been identified at time of analysis, but the hardcoded key class of vulnerability (CWE-321) is well-understood and trivially reversible once discovered.
Hardcoded shared Bluetooth authentication key in KARR BT and DR-100 dealer-installed automotive anti-theft systems allows any attacker within Bluetooth range to issue unauthorized commands to affected vehicles without credentials. Exploitation requires only physical proximity and basic Bluetooth tooling, enabling door unlocking and engine immobilization on any unit sharing the static key. No public exploit or CISA KEV listing has been identified at time of analysis, but the hardcoded key class of vulnerability (CWE-321) is well-understood and trivially reversible once discovered.