The KARR Bluetooth Vulnerability: What Dealers Should Know About Connected Vehicle Security

The KARR vulnerability shows why dealers should understand how connected-vehicle systems communicate and what vehicle functions they can access.

UC San Diego researchers recently disclosed vulnerabilities in certain KARR/SWDS aftermarket vehicle systems.

The researchers estimate that at least 2.2 million vehicles had vulnerable systems installed. According to the research, the issue involved shared Bluetooth authentication and hardware capable of interacting with vehicle functions including door locks and the immobilizer.

Acrisure released a firmware update for the affected KARR/SWDS systems on July 20, 2026. For dealers, the larger lesson is not that Bluetooth, wired hardware or aftermarket systems are inherently unsafe. The important questions are what installed technology can access, what it can control and how that access is protected.

Those questions matter anywhere connected hardware is installed across dealership inventory, whether the system supports theft protection, vehicle location, inventory management or customer-facing features.

What Happened With the KARR Security System?

Researchers from UC San Diego studied six aftermarket Bluetooth Low Energy remote-control systems that add smartphone-based vehicle functions. Their work focused on pairing, authentication and encryption between the phone and hardware installed in the vehicle. KARR was one of the dealer-installed systems included in the research.

Dealers who want the technical detail can review the researchers’ full paper, BLE Theft Auto: Evaluating the Security of Aftermarket BLE-based Automotive Remote Control Systems.

According to UC San Diego, KARR/SWDS devices had been installed by dealerships since 2017. Researchers disclosed the vulnerabilities to KARR and its remote-control system developer on January 21, 2025, including an in-person demonstration. The findings became public in July 2026.

UC San Diego researchers estimated that at least 2.2 million vehicles had vulnerable dealer-installed systems. The affected hardware was found across multiple vehicle makes and was especially common in vehicles originally sold through Southern California dealerships. Used-vehicle sales have since moved some of those vehicles well beyond that market.

CISA identifies the issue as CVE-2026-18411 and lists affected KARR BT and DR-100 versions. Acrisure released updated firmware on July 20, 2026.

The existence of a patch matters. This article focuses on what dealers can learn from the system design described in the public research. It does not suggest that every current KARR product or updated device remains vulnerable.

Why Did the KARR Bluetooth Vulnerability Matter?

In the KARR systems examined by UC San Diego, a smartphone communicated with installed vehicle hardware over Bluetooth. That connection supported functions similar to a key fob, including locking and unlocking doors, operating the horn and lights, and interacting with the immobilizer.

The researchers found weaknesses in the authentication protecting that connection. Their analysis described a shared authentication key across affected KARR/SWDS devices, which meant the problem was not limited to the credentials for a single vehicle.

CISA describes the underlying issue as a shared Bluetooth authentication key across affected KARR Security System and SWDS devices. According to the advisory, successful exploitation could allow unauthorized vehicle-control operations while someone is within Bluetooth range.

Bluetooth itself was not the vulnerability. The risk came from the combination of a nearby Bluetooth connection, weaknesses in authentication and installed hardware that could issue vehicle-control commands.

What Can an Installed Vehicle Device Actually Do?

One of the most useful questions a dealership can ask is also one of the simplest: What can this device do once it is connected to the vehicle?

There is an important difference between reading vehicle information and changing what the vehicle does.

The KARR research involved hardware with remote-control capabilities. UC San Diego documented functions including door locks, horn and light operation, and immobilizer controls.

CarRx serves a different role. It provides vehicle visibility and vehicle information without issuing commands that control vehicle functions.

CarRx’s CAN bus communication is limited to read-only requests and responses for vehicle data. It does not send commands that lock or unlock doors, affect ignition, disable a vehicle, activate alarms, operate lights or sound the horn.

Dealers can learn more about how CarRx supports dealership lot management, including inventory location and vehicle readiness.

How Is the CarRx Connection Different?

The connection path described in the KARR research can be simplified this way:

In the research description, the smartphone communicated directly with hardware installed in the vehicle. Because that hardware could control supported vehicle functions, authentication protecting that connection was especially important.

CarRx uses a different connection path. The CarRx mobile app communicates with the CarRx platform rather than establishing a direct Bluetooth control connection with the installed vehicle device. The installed device communicates with the CarRx platform through a cellular connection.

This does not mean cellular technology is automatically secure or Bluetooth technology is automatically insecure. The relevant difference is what the connection is allowed to do and how that access is protected. The nearby phone-to-device Bluetooth control path described in the KARR research is not part of the CarRx design.

Dealers interested in how vehicle visibility can support inventory security can also review CarRx theft protection and stolen vehicle recovery capabilities.

KARR and CarRx Use Different Vehicle Access Models

The comparison below is limited to the affected KARR/SWDS system design described in the cited UC San Diego and CISA materials and the current CarRx design. It is not a comparison of every KARR product or configuration.

The point of the comparison is narrow. The reported KARR/SWDS vulnerability involved a nearby smartphone connecting through Bluetooth to command-capable hardware. CarRx does not use that phone-to-device Bluetooth control path and does not issue commands that control the vehicle.

Does Wired, Wireless or Bluetooth Determine Whether a System Is Secure?

No. The communication or installation method alone does not determine whether connected-vehicle technology is secure.

The UC San Diego team analyzed six aftermarket Bluetooth Low Energy remote-control systems and found that their security varied considerably. Researchers identified critical pairing or authentication vulnerabilities in three systems, while the other systems they tested used stronger security measures.

That is why a dealer security review should go beyond whether a device is wired, wireless, cellular or Bluetooth-enabled. A provider should be able to explain:

• How the device communicates
• How users and devices are authenticated
• What information the hardware can read
• What vehicle functions, if any, it can control
• How credentials are assigned and protected
• How security updates reach installed devices
• What happens to access after the vehicle is sold

Installation method is one part of the system. It does not tell the entire security story.

Five Questions to Ask Before Installing Connected Hardware Across Your Inventory

A GM or Dealer Principal does not need to audit firmware. The technology provider should still be able to answer a few practical questions before its hardware is installed across a store’s inventory.

1. How Does the Installed Device Communicate?

Ask whether a smartphone communicates directly with the hardware and whether the system uses Bluetooth, cellular service or another communication method. Understanding the connection path makes it easier to understand what needs to be protected.

2. Can the System Control Vehicle Functions?

Ask specifically whether the installed hardware can lock or unlock doors, affect ignition, immobilize or disable a vehicle, activate an alarm, operate lights, sound the horn or issue other vehicle commands. A device that reads information has a different role from hardware designed to control vehicle functions.

3. How Are Users and Devices Authenticated?

The provider should be able to explain how credentials are assigned, how new users or devices are authorized and what prevents an unauthorized device from connecting. The KARR disclosure is one example of why authentication design matters.

4. How Are Security Updates Handled?

Dealers should understand how vulnerabilities are reported and addressed, how firmware updates reach installed hardware and whether the dealership or vehicle owner needs to take action. A security fix only helps when affected devices receive it.

5. What Happens After the Vehicle Is Sold?

Dealers should know whether dealership access changes after the sale, who can see vehicle location, what vehicle information may still be shared and how customer consent is handled.

What Happens to Vehicle Access After the Sale?

Technical security is only one part of connected-vehicle due diligence. Dealerships should also understand what happens to vehicle information when ownership changes.

With CarRx, dealership access changes after the sale. Vehicle location is visible to the registered owner and is not visible to the dealership.

If an owner activates CarRx, they can choose to share specific vehicle information with their dealership to support future service needs, including odometer mileage and diagnostic trouble codes. That shared information does not include the customer’s vehicle location.

Drivers looking for more information about registration, location access and CarRx features can visit the
CarRx Driver FAQ.

What Dealers Should Take From the KARR Disclosure

The KARR disclosure gives dealers a concrete reason to ask better questions about technology installed across their inventory.

The review does not need to start with a technical debate over wired versus wireless or cellular versus Bluetooth. Start with what the system actually does: how it connects, what it can access, what it can control, how that access is protected, how updates are handled and who retains access after the vehicle is sold.

Those answers tell a dealership far more about a connected-vehicle system than a label like GPS, Bluetooth, wired or wireless.

Review Connected-Vehicle Security Before You Choose a Provider

The CarRx Dealer Security Brief gives dealership leaders a practical framework for reviewing connected-vehicle design, vehicle data, customer privacy and vendor security practices.

Download: What Dealers Should Know About Connected-Vehicle Security

Dealers with questions about how CarRx handles vehicle communication, data access and post-sale privacy can also contact the CarRx team.