Exploitation ongoing with high activity in latest observed window (3 mentions)
Recommended action window: Immediate (within 24h)
NVD description
The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker within Bluetooth range can leverage this weakness to issue unauthorized commands to the vehicle, potentially allowing unauthorized access to vehicle functions, including door unlocking and engine immobilization.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-05 | 1 | Active Exploitation1 |
| 2026-08-06 | 3 | Disclosure1General2 |
CVE-2026-18411 The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker within… https://www.cve.org/CVERecord?id=CVE-2026-18411
Post summary
The post notes CVE‑2026‑18411, pointing out that KARR Security and SWDS anti‑theft systems share a Bluetooth authentication key, but offers no evidence of PoC, exploitation, or patch details.
TRC analysis shows attackers exploiting CVE-2026-18411 can compromise millions of vehicles through a universal Bluetooth key in KARR Security Systems. Researchers observed lateral movement between vehicles using the shared vulnerability, enabling unauthorized door unlocks and engine disabling. Runtime segmentation could help limit blast radius in connected vehicle fleets. #IoTSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/acrisure-karr-bt-dr-100-bluetooth-vulnerability-cve-2026-18411
Post summary
The tweet confirms that attackers are actively exploiting CVE‑2026‑18411 to compromise and remotely control vehicles via shared Bluetooth credentials, with documented lateral movement across fleets.
⚠️ Vulnerabilidad en productos Bluetooth ❗ CVE-2026-18411 ➡️ Más info: https://www.cert.gov.py/vulnerabilidad-en-productos-bluetooth/ https://t.co/yh7y6pXSHu
Post summary
The text announces a new Bluetooth vulnerability identified as CVE-2026-18411 and links to a site for additional details, but it does not provide technical specifics, PoC, exploit, or patch information.
🚨*CVE* CVE-2026-18411 The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker within… https://www.cve.org/CVERecord?id=CVE-2026-18411 ----- Traducción: CVE-2026-18411 El … http://infoflow.cloud`
Post summary
The post points to the CVE record and briefly notes a shared Bluetooth key vulnerability but offers no exploit, patch, or evidence of active use.