A security researcher discovered a method to elevate privileges to root on the navigation unit of a 2014 Renault Latitude equipped with a TomTom Carminat LIVE head unit running a Linux-based custom system. The findings were published on November 2, 2026, and highlight how outdated in-car software can still contain significant vulnerabilities. The researcher, Rasmus Moorats, initially set out to find a way to exploit a known vulnerability but ended up uncovering a more serious issue.
The "Set Time" option was absent, and the settings menu wouldn't open without a genuine SD card. Embedded devices often make common mistakes, such as executing scripts from removable media, running parsers with root privileges, and failing to clean file paths. A recent report on Android car screen malware details a multi-stage downloader that uses the built-in update path to connect infected screens to an ad fraud and proxy botnet.
Here are the indicators of compromise (IoCs): - Device: TomTom Carminat LIVE (codename “beaumont”) Affected navigation unit in the 2014 Renault Latitude - Operating system: TomTom custom OS on Linux 2.6.28.10 Old kernel that supports the core_pattern trick - Hardware: Samsung S5P6440 SoC Chip inside the unit - File on SD card: master.script For rapid incident containment, ensure your SOC integrates alerts with threat intelligence from platforms like MISP, VirusTotal, or your SIEM.
