Researcher shows root access on 2014 Renault TomTom unit
First merged summary.
A malicious SD card can gain root on a 2014 Renault Latitude TomTom unit after physical insertion and user approval; no update exists.
Researcher Rasmus Moorats found that a malicious SD card can lead to root code execution on the TomTom Carminat LIVE navigation unit in a 2014 Renault Latitude. The unit runs a custom Linux 2.6.28.10 system on Samsung S5P6440 hardware. Flaws in the ttn parser, including path traversal through a LOG command and an issue in SHEX, combine with a kernel core_pattern technique after the user confirms the master.script prompt. The chain needs physical access and user approval; remote exploitation is not possible. It can reach navigation history and eMMC storage, including backups and timezone changes. No updates are available for the roughly 15-year-old system.
- Affects TomTom Carminat LIVE in a 2014 Renault Latitude.
- Runs custom Linux 2.6.28.10 on Samsung S5P6440 hardware.
- Requires physical SD card insertion and master.script approval.
- Parser flaws involve LOG path traversal and SHEX.
- No software updates are available; remote exploitation is not possible.
What each outlet adds
beyond the shared facts- Cyber Security NewsNotes no updates, noexec bypass, eMMC backup and timezone changes.
- GBHackersNames LOG and SHEX flaws and says remote exploitation is impossible.
- Vendors
- Renault
Coverage
oldest first · one row per article · UTC- · 8d ago
Cyber Security NewsFirst report
Renault Navigation Software Allows Root Code Execution via Path Traversal
2014 Renault Latitude TomTom head unit vulnerable to root compromise through malicious SD card using old Linux kernel.
- · 8d ago
GBHackers
Path Traversal Flaw in Renault Navigation System Enables Root Code Execution
Malicious SD card exploits path traversal in old TomTom system to achieve root code execution on 2014 Renault Latitude.