Advisories › Acrisure › ICSA-26-216-01
Acrisure KARR BT and DR-100: 1 CVE, High 8.1
Summary
CISA reports 1 vulnerability in Acrisure KARR BT, DR-100. Weakness type: Use of Hard-coded Cryptographic Key. Successful exploitation of this vulnerability could allow an attacker to perform unauthorized vehicle control operations. Highest CVSS v3 score: 8.1 (High), exploitable from an adjacent network.
What to do: Prioritize: Acrisure Protection Group released a firmware update on July 20, 2026, to address this vulnerability.
At a glance
- Vendor
- Acrisure
- Products
- KARR BT, DR-100
- CVEs
- CVE-2026-18411
- Highest CVSS v3
- 8.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Transportation Systems
- Deployed
- Worldwide
- Vendor HQ
- United States
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-18411 | Use of Hard-coded Cryptographic Key | 8.1 | – | No | The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker within Bluetooth range can leverage this weakness to issue unauthorized commands to the vehicle, potentially allowing unauthorized access to vehicle functions, including door unlocking and engine immobilization. |
Affected products (2)
- Acrisure KARR BT: <July 26, 2026
- Acrisure DR-100: <July 26, 2026
Vendor fixes and mitigations (from advisory)
- Mitigation: Acrisure Protection Group released a firmware update on July 20, 2026, to address this vulnerability. They recommend that affected users should follow the directions found here: https://www.karrsecurity.com/karr-security-firmware-update-instructions. link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.