A security researcher has demonstrated that a malicious SD card can enable root-level code execution on the TomTom Carminat LIVE navigation unit found in certain Renault vehicles. The script uses a custom language to automate menu actions, and the ttn program that parses it operates as root. Renault TomTom Root Vulnerability The researcher identified two vulnerabilities in the script parser: The `LOG` command writes one line of printable text to a file chosen by the script.
He exploited the LOG flaw to inject code into `/proc/sys/kernel/core_pattern`, which dictates what happens when a program crashes. The final script contained only three lines: #define LOGFILE ../../proc/sys/kernel/core_pattern LOG |/bin/sh /media/sdcard/payload.sh SHEX /bin/dbus-monitor The initial proof of concept was simply a reboot, demonstrating root code execution. The researcher backed up the internal eMMC storage using dd and modified the settings.dat file to change the timezone to UTC+2, as NNS mentioned.
Its map-card DRM uses a unique CID for each card and signed files, and firmware updates are signature-checked. Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort.
