Overview
- UC San Diego researchers found in January 2025 that KARR alarm units share a single authentication key stored in plain text inside the official smartphone app, which lets one extracted key talk to all affected devices.
- The research team built a proof‑of‑concept Android tool that demonstrated nearby attackers can unlock doors, disable alarms, stop a parked car from starting, and trigger horns and lights.
- Acrisure published a firmware update on July 20, 2026 to fix the flaw and said it will notify owners and dealers about the patch.
- Researchers warn the patch distribution method is the weak link because many buyers never downloaded the KARR app and UCSD estimates roughly half of the estimated 2.2 million Bluetooth‑enabled units in U.S. cars may not receive the update.
- Owners should check for KARR or SWDS stickers on the driver window or a small blinking button under the dash and download the KARR iPhone or Android app to run the firmware update or contact their dealer for help, and the case raises questions about dealer disclosure and rules for aftermarket security hardware.