The vulnerability in the Acrisure KARR BT and DR-100 systems stems from the use of a hard‑coded, shared Bluetooth authentication key. This weakness allows an attacker within Bluetooth range to authenticate to the vehicle’s anti-theft system and send commands that can unlock doors or trigger engine immobilization. The flaw is a classic example of CWE-321, a weak cryptographic key, and its impact is the potential for remote exploitation of critical vehicle functions.

All vehicles equipped with the Acrisure KARR Security System or SWDS dealer‑installed anti‑theft devices that share the same Bluetooth authentication key are affected. Both the KARR BT and DR‑100 product lines issued before July 20, 2026 are impacted. No specific firmware versions were listed in the advisory, so all versions prior to the July 20 update should be considered vulnerable.

The CVSS score of 7.2 indicates a high severity with some impact on confidentiality, integrity, and availability. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. The attack vector is local, requiring the attacker to be within Bluetooth range. Once inside range, the attacker can exploit the key reuse to gain unauthorized access to vehicle functions. The lack of a publicly known exploit does not reduce the risk because the weakness is inherent in the device design and can be leveraged with standard Bluetooth tools.