Path Traversal Flaw in Renault Navigation System Enables Root Code Execution
Original title: Researcher Discovers Path Traversal Flaw in Renault Navigation System That Enables Root Code Execution
Malicious SD card exploits path traversal in old TomTom system to achieve root code execution on 2014 Renault Latitude.
Security researcher Rasmus Moorats discovered that a malicious SD card can trigger path traversal in the TomTom Carminat LIVE navigation unit used in some Renault cars. The unit runs a Linux 2.6.28.10-based system on a Samsung S5P6440 chip. Two flaws in the ttn script parser—one allowing file writes outside intended folders via LOG command and another in SHEX—combine with a kernel core_pattern trick to execute arbitrary code as root after user approval.
- Exploit requires physical SD card insertion and user approval for master.script.
- Uses /proc/sys/kernel/core_pattern pipe to run shell from SD card.
- Provides full root access to navigation history and eMMC storage.
- No remote exploitation possible.
Impact: root code execution on car navigation unit
- Vendors
- Renault
From the original article
2 min read at gbhackers.com
A malicious SD card can give an attacker root-level code execution on the TomTom Carminat LIVE navigation unit used in some Renault cars. Security researcher Rasmus Moorats published the findings on November 2, 2026. It uses a Samsung S5P6440 chip and runs TomTom’s custom operating system, which is based on Linux 2.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.