KARR aftermarket security vulnerability

University of California, San Diego researchers disclosed a Bluetooth flaw in the aftermarket KARR security system, installed by dealers in more than two million vehicles in the United States and Brazil. A single universal master key embedded in every module lets an attacker within Bluetooth range lock or unlock doors, sound the horn, flash lights and, in some cases, cut engine power.

The hardware is typically added by dealerships for inventory management and often remains active after owners decline the paid alarm service, meaning many drivers are unaware of its presence. Because KARR operates outside the vehicle’s native electronic architecture, conventional over‑the‑air updates or manufacturer recalls cannot reach it.

Acrisure Protection Group issued a firmware patch on 20 July 2025. Owners must locate the KARR module, install the update through the companion mobile app, and verify removal of the module’s indicator light or sticker. The patch does not enable remote starting and cannot control a vehicle while it is being driven.

Follow‑up research published in July 2026 reaffirmed that the shared authentication key still permits a single exploit across all units, affecting over two million cars—especially in Southern California—and a publicly accessible database now lists the affected VINs. A related SWDS anti‑theft device, built by Acrisure and using the same key, is estimated to be present in roughly 2.2 million vehicles purchased since 2017, with exposure spreading to other U.S. states and Japan through the secondary market. Removing the devices requires extensive hardware work, as the key cannot be changed or Bluetooth disabled remotely.

Security experts continue to advise motorists to check dashboards for the KARR badge, keep the mobile app up‑to‑date, and consider professional removal if the firmware update is insufficient.