A critical Bluetooth vulnerability in dealer-installed KARR Security Systems is putting over 2 million vehicles at risk of unauthorized access and immobilization. This situation has prompted urgent calls for drivers to update affected devices.
Researchers at the University of California, San Diego, revealed that the flaw allows attackers within Bluetooth range to issue commands such as locking or unlocking doors, disabling alarms, triggering horns and lights, and even preventing a vehicle from starting.
Although the vulnerability does not allow for remote driving or control of a moving vehicle, it significantly lowers the barrier for physical theft by enabling silent entry into targeted cars.
KARR Bluetooth Vulnerability
The issue affects aftermarket KARR alarm hardware commonly installed by dealerships to secure vehicles on sales lots. In many cases, these systems remain in vehicles even after purchase, including when customers decline the paid subscription service.
This creates a unique security gap since the affected hardware operates outside the automakers’ official software ecosystems, which prevents traditional over-the-air updates and centralized patch management. Consequently, the responsibility for remediation falls on end users and the third-party vendor, Acrisure Protection Group.
At the core of the vulnerability is a shared Bluetooth authentication key that is embedded across KARR devices. Researchers uncovered this key by reverse engineering the official KARR mobile application, which enabled them to create a proof-of-concept Android app capable of impersonating legitimate user commands.
Using this method, the team demonstrated real-world attack scenarios, including simultaneously triggering multiple vehicles and blocking engine ignition. While Acrisure described the exploit as “highly complex,” the researchers showed that once developed, the attack could be executed using standard consumer hardware.
The risk is further compounded by the system’s behavior even when deactivated. Researchers found that dormant KARR units continue to broadcast Bluetooth signals while the vehicle is running and for up to 10 minutes after shutdown. This allows attackers to remotely activate the system before issuing harmful commands.
In vehicles where the service is inactive, such activation may briefly alert owners through audible or visual signals, but fully subscribed systems may not provide any warning.
In addition to direct exploitation, the KARR system raises a privacy concern by continuously broadcasting identifiable Bluetooth signals. Utilizing data from the WiGLE wireless tracking database, researchers estimated at least 2.2 million deployed units and demonstrated how historical signal data could reveal vehicle movement patterns or frequent locations.
During field testing, researchers identified 97 vulnerable vehicles within a 20-minute drive of UC San Diego, highlighting the widespread nature of the issue, as reported by Apple Insider.
Acrisure released a firmware patch on July 20, 2026, addressing the vulnerability ahead of coordinated disclosures at DEF CON and the USENIX Security Symposium. Vehicle owners are advised to install the KARR Security app, connect it to their vehicle, and apply the firmware update immediately.
Drivers unsure whether their vehicle is affected should check for KARR or SWDS branding or consult their dealership. This incident highlights broader concerns regarding undocumented aftermarket hardware and the growing attack surface introduced by third-party automotive technologies.
ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.
