The Acrisure KARR BT security system uses a shared, hard-coded cryptographic key for Bluetooth authentication across affected devices. This weakness (CWE-321) enables an attacker in Bluetooth proximity to bypass authentication controls and send unauthorized commands to the vehicle, such as unlocking doors or disabling engine immobilization. The CVSS 4.0 vector indicates the attack requires adjacent network access with low complexity and no privileges or user interaction, resulting in high impact on integrity and availability. No vendor advisory or patch information is currently available.

An attacker within Bluetooth range can exploit the hard-coded key to gain unauthorized access to vehicle functions, including unlocking doors and disabling engine immobilization. This compromises vehicle security and could lead to theft or unauthorized use. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should limit Bluetooth exposure and monitor for suspicious activity. No official fix or temporary mitigation has been published by the vendor.