A security researcher has found a way to run any command with root rights on the navigation unit in a 2014 Renault Latitude.

The unit is a TomTom Carminat LIVE head unit that runs a custom system built on Linux 2.6.28.10. The research was published on November 2, 2026, and it shows how old in-car software can still hide serious weaknesses.

The researcher is Rasmus Moorats. He did not start out to hack anything. He only wanted to fix the clock after daylight saving time ended in Estonia.

The “Set time” option was missing, and the settings menu would not open without a genuine map SD card. Analysts at NNS.ee noted that the problem comes from the way the unit reads a script file from the SD card.

They described a chain of small flaws that, when joined, give full control of the device. Cars like this are common, and many hold years of phone contacts and location data. Newer cars face similar risks, as shown in the PerfektBlue Bluetooth flaws that put millions of vehicles at risk.

Renault Car’s 15-Year-Old Linux Navigation Software Hacked

The unit has more protection than you would expect from 2011 software. Most partitions are read-only, “noexec” (which blocks programs from running), or both.

The system also checks SD cards with DRM, so a blank card or a copied card is rejected. Update images carry a signature too, so the researcher could not simply flash a changed system image.

To study the unit safely, he built an emulator with QEMU. The emulator showed him which files the unit reads from the SD card at boot. One of them is master.script, a small script that automates screen actions. A program called ttn parses it, and ttn runs as root.

Two commands in that script proved useful. SHEX runs a program from the system, but it accepts only one word, so no arguments can be passed.

Hacked system (Source - NNS.ee) — Hacked system (Source – NNS.ee)

The LOG command writes one line of plain text to a file, and it has a path traversal bug. Adding “../” to the log file path lets the writer reach outside the intended folder. Because ttn is root, every write is also made as root.

Neither bug was enough alone. The root file system was read-only, and the SD card could not run programs. The researcher then borrowed a trick from kernel exploits.

He used the LOG command to write into /proc/sys/kernel/core_pattern, the setting that tells Linux what to do when a program crashes.

He wrote a pipe command there that makes the kernel start /bin/sh with a script from the SD card. The kernel then ran the script as root.

To trigger a crash, he used SHEX to start /bin/dbus-monitor, which aborts when it cannot find the system bus. The final script was only three lines long.

His first proof was simple: the payload rebooted the unit. He then used the access to back up the internal storage with dd. He found the time setting in /mnt/flash/settings.dat and changed the offset from UTC+3 to UTC+2.

Why Old Car Software Is Still a Risk

This case was a research project done with physical access to the car, so it is not a remote threat. A criminal would need to insert a prepared SD card, and the driver would have to answer “Yes” to the “Execute master.script?” prompt.

That limits the risk, but it does not remove it. A shared car, a rental, or a repair shop visit could give someone that chance. The deeper issue is design. The unit trusts a script from removable media, runs the parser as root, and does not clean file paths.

These are common mistakes in embedded devices, and they last for as long as the car stays on the road. A car can be driven for 15 years or more, and head units rarely get patches.

Researchers keep finding the same pattern in newer vehicles. A Nissan Leaf infotainment flaw showed how a weak Bluetooth component could lead to control of doors, mirrors, and steering. That unit ran Linux 3.14, which dates from 2013.

Head units are also a target for criminals who want to make money. A recent report on Android car screen malware described a multi-stage downloader that used the built-in update path to join infected screens to an ad fraud and proxy botnet.

Even in that case, the report did not show control of steering or braking. Old Linux gadgets are also exposed in other ways. The Kairos botnet, for example, takes over Linux devices that allow passwordless Telnet root logins.

Owners of older cars have few options. They should keep unknown SD cards and USB sticks out of the head unit and buy map cards only from trusted sellers. They should also ask the dealer whether any security update exists.

Indicators of compromise (IoCs):-

Type	Indicator	What it means
Device	TomTom Carminat LIVE (codename “beaumont”)	Affected navigation unit in the 2014 Renault Latitude
Operating system	TomTom custom OS on Linux 2.6.28.10	Old kernel that supports the core_pattern trick
Hardware	Samsung S5P6440 SoC	Chip inside the unit
File on SD card	master.script

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Renault Car’s 15-Year-Old Linux Navigation Software Hacked to Execute Arbitrary Root Commands appeared first on Cyber Security News.