The original text is in EN, taken from the source site. Source ↗

A malicious SD card can give an attacker root-level code execution on the TomTom Carminat LIVE navigation unit used in some Renault cars. Security researcher Rasmus Moorats published the findings on November 2, 2026.

It uses a Samsung S5P6440 chip and runs TomTom’s custom operating system, which is based on Linux 2.6.28.10. That kernel is very old, and it predates many modern exploit mitigations.

At every boot the unit looks for a file called master.script on the SD card. The user must press “Yes” at an “Execute master.script?” prompt before it runs.

The script uses a custom automation language for menu actions. The ttn program that parses it runs as root, so any flaw in the parser can lead to full compromise.

Moorats found two weaknesses in the parser. The LOG command writes one line of printable text to a file the script names.

It does not sanitize the path, so a ../ sequence lets the script write outside the intended log folder. This is a classic path traversal flaw. The SHEX command runs a program already on the device, but it cannot pass arguments.

Moorats wanted to fix the clock on his 2014 Renault Latitude. That small goal led him to the head unit, codenamed “beaumont.” nns.said.

Neither flaw looked useful at first. The root filesystem was read-only, and nearly every other partition, including the SD card, was mounted noexec, which blocks direct execution of programs from those partitions.

Moorats borrowed a technique familiar from Linux kernel exploitation. He used the LOG flaw to write into /proc/sys/kernel/core_pattern, the setting that tells the kernel what to do when a process crashes.

Romeo vulnerability (Source : nns).

When the value begins with a pipe character, the kernel runs the named program and feeds it the crash data. He set it to |/bin/sh /media/sdcard/payload.sh.

The noexec flag did not block this, because /bin/sh is a binary on an executable partition. The shell only reads the payload from the SD card as data.

SHEX then launched /bin/dbus-monitor, which crashes when it cannot find the system bus. The kernel handled the crash by running the attacker’s script with root privileges.

The whole exploit is three lines: a #define LOGFILE directive pointing at ../../proc/sys/kernel/core_pattern, a LOG line carrying the pipe payload, and a SHEX call to /bin/dbus-monitor.

The first proof of concept simply rebooted the unit, which confirmed root code execution. Moorats then used the access to back up the internal eMMC storage with dd. He also edited settings.dat to change the timezone to UTC+2, which solved his original problem.

The attack needs physical access to the car, and a user must accept the script prompt. That makes remote or mass exploitation unlikely.

The realistic risks are a tampered SD card handed over during valet service or repair, or a social-engineering scenario.

Root access also exposes stored data such as navigation history, and it could allow persistent modification of the unit. The researcher’s work shows that the unit’s other defenses did not stop the attack.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.