A Bluetooth vulnerability discovered in aftermarket security devices sold by dealerships could expose approximately 2.2 million vehicles to unauthorized access, according to researchers at the University of California San Diego.
The flaw affects KARR and SWDS (Southwest Dealer Services) branded security systems, which are often installed by dealerships before a vehicle is sold. A person within roughly five yards of a vulnerable vehicle can use Bluetooth to connect to the device. This connection could allow an attacker to unlock or lock doors, silence alarms, flash headlights, or prevent the vehicle from starting. However, researchers noted the vulnerability does not allow for starting the engine or shutting down a vehicle already in operation.
These KARR and SWDS systems are not factory-installed by automakers like Cadillac, Hyundai, or Ford. Instead, dealerships or their vendors add the hardware, sometimes to protect inventory on their lots. In some cases, the hardware remains connected even if the buyer declines the security service, leaving owners unaware of the potential vulnerability.
The security devices communicate with a smartphone app via Bluetooth Low Energy. Researchers found that the affected devices shared a common authentication key, allowing them to be compromised once this key was discovered. The devices also broadcast identifiable Bluetooth signals, which could potentially be used to track a vehicle's regular parking or travel locations, raising privacy concerns.
While the UC San Diego study identified these devices most frequently in vehicles sold at Honda, Toyota, Mazda, Ford, and Jeep dealerships in Southern California since 2017, the scope could be wider. KARR partners with over 3,000 dealerships nationwide, and vehicles are frequently moved through used car sales and trades.
Owners can check for these devices by looking for KARR or SWDS stickers on the driver-side window. A physical inspection beneath the driver-side dashboard may reveal a small button or indicator light, often connected to wiring. Reviewing vehicle sales paperwork for mentions of KARR, SWDS, or similar dealer-installed security systems is also recommended. Contacting the selling dealership with the vehicle's VIN to inquire about installed aftermarket security modules can also provide confirmation.
Acrisure, the company behind KARR, released a firmware patch for the vulnerability on July 20, 2026. Vehicle owners can update their systems through the official KARR Security app. For activated systems, users can log in, select their vehicle, and check for updates in the settings. For systems that were never activated, the app can guide users through a VIN check and update process.
KARR Security stated that they maintain rigorous standards and that the vulnerability presents a low risk under real-world conditions. The company added that, to their knowledge, the vulnerability has not been used to steal a vehicle. They advise customers to apply the firmware update via their app. If owners no longer wish to have the system, professional removal by a qualified technician is recommended, as incorrect disconnection could affect the vehicle's ignition or other electrical systems.