OTPulse

Acrisure KARR BT and DR-100

Plan PatchCVSS 8.1ICS-CERT ICSA-26-216-01Aug 4, 2026
Attack path
Attack VectorAdjacent
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

KARR BT and DR-100 devices contain a vulnerability that allows unauthorized vehicle control operations. An attacker on the local network can exploit this without authentication. Acrisure Protection Group released a firmware update on July 20, 2026 to address this issue.

What this means
What could happen
An attacker on your local network could gain control of vehicle access and security functions on KARR BT and DR-100 devices, potentially allowing unauthorized entry or disabling safety interlocks.
Who's at risk
Security and fleet managers responsible for Acrisure KARR BT and DR-100 vehicle access control and remote monitoring systems should prioritize this vulnerability, as it affects the ability to maintain secure vehicle access and operational security.
How it could be exploited
An attacker with access to the same network segment as a KARR BT or DR-100 device could send malicious commands to the device without authentication, enabling them to perform unauthorized vehicle control operations such as unlocking doors or disabling alarms.
Prerequisites
  • Network access to the same local network segment (Ethernet or wireless) as the KARR BT or DR-100 device
  • No authentication credentials required
remotely exploitableno authentication requiredlow complexityaffects safety systems
Exploitability
Unlikely to be exploited — EPSS score 0.2%
Affected products (2)
2 pending
ProductAffected VersionsFix Status
KARR BT: <July 26, 2026<July 26, 2026No fix yet
DR-100: <July 26, 2026<July 26, 2026No fix yet
Remediation & Mitigation
0/3
Do now
0/2
HARDENINGIsolate KARR BT and DR-100 devices on a restricted network segment separate from general IT networks until firmware update can be applied
HARDENINGImplement network access controls to restrict traffic to KARR BT and DR-100 devices to authorized management systems only
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply firmware update released July 20, 2026 to all KARR BT and DR-100 devices by following vendor instructions at https://www.karrsecurity.com/karr-security-firmware-update-instructions
View full CISA ICS-CERT advisory
API: /api/v1/advisories/2848eae7-f4a9-4b71-8610-17066ed7d394

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Acrisure KARR BT and DR-100 | CVSS 8.1 - OTPulse