KARR Security System flaw puts over 2 million vehicles at risk

A Bluetooth vulnerability in the aftermarket KARR Security System, installed by dealers on vehicles such as Honda, Toyota, Mazda, Ford and Jeep, allows attackers within range to lock or unlock doors, sound the horn, flash lights and prevent a parked car from starting. Researchers at the University of California, San Diego demonstrated the flaw, which affects more than two million cars in Brazil and the United States, particularly in Southern California. The security device uses a shared authentication key, making a single exploit possible across all units.

Acrisure Protection Group released a firmware update on July 20, 2025. Owners can apply the patch through the KARR Security app on iPhone or Android devices. Updating is complicated because many customers never subscribed to the paid alarm service and the hardware remains active after purchase, broadcasting Bluetooth signals for up to ten minutes after shutdown. The fix does not enable remote starting of vehicles and cannot control a car while it is being driven.