KARR Security Vulnerability: What Drivers Should Know About Dealer-Installed Connected Vehicle Technology 

 

If your vehicle has KARR or SWDS hardware installed, check whether it has received the latest firmware update, even if you never activated the service.

Researchers at the University of California San Diego identified security vulnerabilities in KARR and several other aftermarket automotive systems that use Bluetooth Low Energy, or BLE. According to the researchers, the KARR vulnerability could allow an unauthorized person within Bluetooth range to interact with vehicle functions including the door locks and immobilizer. 

UC San Diego estimates that at least 2.2 million vehicles are affected by the KARR/SWDS vulnerability. KARR’s parent company, Acrisure, released a firmware update on July 20, 2026, to address the issue. 

The research identified a vulnerability. It does not mean every vehicle with an affected system was accessed or compromised. 

What Researchers Found in the KARR Security System 

The UC San Diego team evaluated six aftermarket automotive systems that communicate with vehicles over Bluetooth. 

Researchers found critical pairing or authentication vulnerabilities in three of them: KARR, CarLink and Rockledge. The other three Bluetooth-based systems in the study used stronger security protections. 

Bluetooth itself was not the finding. The researchers identified problems with how certain systems handled authentication before allowing a device to interact with the vehicle. 

Depending on how it is installed, a KARR system can perform functions similar to a key fob. Those functions can include locking and unlocking doors, sounding the horn, flashing the lights and preventing the vehicle from starting. 

When aftermarket hardware has that level of access to a vehicle, the way commands are authenticated matters. 

How to Check Whether Your Vehicle Has a KARR System 

Some owners already know they purchased KARR Security with their vehicle. Others may have KARR hardware installed even though they never activated the paid service. 

UC San Diego reports that many affected vehicles can be identified by a KARR or SWDS sticker on the driver’s-side window. Researchers also reported that KARR hardware could remain installed and active when the vehicle buyer declined the service. 

UC San Diego affected-vehicle identification guide 

KARR provides separate instructions for activated and non-activated systems. 

If your KARR service is active, you can use the KARR Security app to check for firmware updates. 

If you did not activate KARR but believe the hardware may be installed, KARR directs owners to download the app and follow its customer-support process. That process uses the vehicle’s VIN to determine whether an update is needed. 

What KARR Owners Should Do 

If your vehicle may have a KARR or SWDS system, start by confirming whether the hardware is installed and whether its firmware is current. 

KARR currently recommends that activated customers check the KARR Security app for updates. Owners who did not activate the service can also use KARR’s app and customer-support process to verify the vehicle and complete the update if necessary. 

KARR lists customer support at 800-395-5277. 

KARR official firmware update instructions 

Follow the manufacturer’s update process rather than trying to remove or modify the hardware yourself. UC San Diego researchers note that removing the system may not be straightforward because the hardware can be connected to vehicle wiring and the ignition system. 

What to Know About Dealer-Installed Connected Technology 

Dealer-installed products do not all have the same access to a vehicle. 

One device may only read and report vehicle information. Another may be wired into systems that allow it to lock doors, affect the ignition or perform other remote-control functions. 

From the driver’s side, both products may simply appear to be an app connected to the vehicle. The more meaningful difference is what the installed hardware can actually read or control. 

If connected hardware was added to your vehicle before delivery, there are five basic things worth knowing: 

1. What hardware is installed?
   Confirm whether any additional connected equipment was added to the vehicle. 
2. What vehicle systems can it access?
   Reading vehicle information is different from controlling vehicle functions. 
3. Can it send commands to the vehicle?
   Find out whether the system can lock or unlock doors, affect the ignition, disable the vehicle or perform other remote actions. 
4. What information does it collect?
   Depending on the product, that may include location, mileage, diagnostic information or other vehicle data. 
5. How are security updates handled?
   Connected hardware may remain in a vehicle for years. Owners should know how they will be notified when an important update is available. 

These questions tell you more about the system than simply knowing whether it uses Bluetooth, cellular service or GPS. 

Bluetooth Wasn’t the Only Issue 

The UC San Diego study evaluated six automotive systems that used Bluetooth. Three had critical vulnerabilities, while the researchers described the security used by the other three as robust. 

The difference comes down to system design: how a device is authenticated, what access the installed hardware has and what happens after it receives a command. 

A system that only reads vehicle information creates a different set of considerations from one that can change how the vehicle behaves. 

How CarRx Is Designed Differently 

CarRx is also installed in vehicles at participating dealerships, but its architecture differs from the KARR system described in the UC San Diego research. 

The CarRx mobile app does not establish a direct Bluetooth control connection with the device installed in the vehicle. The installed device communicates with the CarRx platform over a cellular connection, while the mobile app communicates with that platform. 

CarRx is also designed to read vehicle information rather than issue vehicle-control commands. It can provide drivers with information about vehicle health, diagnostic issues, maintenance needs and other vehicle conditions.  

Learn more about CarRx Vehicle Health. 

That does not mean one wireless technology is automatically secure and another is not. The relevant questions are what access the hardware has, how communication is authenticated and whether the system can send commands that change how the vehicle behaves. 

What Drivers Should Do Next 

If your vehicle has KARR or SWDS hardware installed, verify that its firmware is current. 

For any connected hardware installed in a vehicle, know what is there, what information it collects, what it can control and how security updates are handled. 

Those details matter because the hardware may remain with the vehicle long after it leaves the dealership.