VULNpocalypse
MediumVulnerabilityActive

Renault Latitude TomTom Carminat LIVE head unit allows root command execution via malicious SD card

A researcher chained a path traversal bug and a script parser running as root to get root code execution on a 2014 Renault Latitude navigation unit.

Published
Updated
Exploitation
No, only researcher proof of concept reported, and both sources describe the attack as needing physical access and a user prompt acceptance

What happened

Security researcher Rasmus Moorats published findings on November 2, 2026, showing root command execution on the TomTom Carminat LIVE head unit in a 2014 Renault Latitude, according to Cyber Security News and GBHackers. He started out only wanting to fix the clock after daylight saving time ended in Estonia (Cyber Security News).

The unit uses a Samsung S5P6440 chip and a TomTom custom operating system based on Linux 2.6.28.10. The head unit is codenamed “beaumont” (GBHackers).

At boot the unit looks for a file named master.script on the SD card. The user must accept an “Execute master.script?” prompt before it runs. A program called ttn parses the script and runs as root (GBHackers, Cyber Security News).

Two script commands were abused:

  • LOG writes one line of text to a named file and does not sanitize the path, so “../“ lets it write outside the intended folder. Because ttn is root, the write is made as root.
  • SHEX runs a program already on the device but cannot pass arguments.

The defenses were otherwise decent. The root file system was read-only, nearly all other partitions including the SD card were noexec, SD cards are checked with DRM, and update images are signed (Cyber Security News, GBHackers).

The researcher used LOG to write to /proc/sys/kernel/core_pattern with a pipe value that makes the kernel run /bin/sh with a payload script from the SD card. noexec did not block this because /bin/sh sits on an executable partition and only reads the payload as data. SHEX then launched /bin/dbus-monitor, which crashes when it cannot find the system bus, and the kernel ran the attacker script as root. The full exploit is three lines (GBHackers).

The first proof of concept rebooted the unit. He then backed up internal storage with dd and changed the time offset in settings.dat from UTC+3 to UTC+2 (Cyber Security News).

No CVE identifier, vendor advisory, or patch is mentioned in either source. Both are news write-ups of the researcher’s work, not official advisories.

Am I affected?

  • Confirmed affected: the TomTom Carminat LIVE head unit (codename “beaumont”) in a 2014 Renault Latitude, running TomTom’s custom OS on Linux 2.6.28.10 (Cyber Security News).
  • GBHackers says the unit is used in “some Renault cars” but does not list models (GBHackers). Other affected models and firmware versions: not confirmed.
  • Exposure is limited. The attack needs physical access to the car, a prepared SD card, and the user accepting the script prompt, so remote or mass exploitation is unlikely (GBHackers).
  • Realistic scenarios named are a shared car, a rental, a repair shop or valet visit, or social engineering (Cyber Security News, GBHackers).
  • Root access could expose stored data such as navigation history and allow persistent modification of the unit (GBHackers). Cyber Security News adds that such units can hold phone contacts and location data.

Indicator to watch for: a master.script file on an SD card used in the unit, and an unexpected “Execute master.script?” prompt.

What to do now

  1. Keep unknown SD cards and USB sticks out of the head unit, and buy map cards only from trusted sellers (Cyber Security News).
  2. Never answer “Yes” to an “Execute master.script?” prompt unless you created that card yourself.
  3. Before handing the car to valet, a repair shop, or a renter, remove your SD card and check that no unfamiliar card is in the slot.
  4. Ask the dealer whether any security update exists. Neither source confirms a patch, so treat a fix as not confirmed (Cyber Security News).
  5. If you suspect a tampered card was used, consider the stored navigation history and contacts on the unit as potentially exposed, and avoid keeping sensitive data on it.
  6. For fleet or rental operators: inspect SD slots at vehicle turnaround and restrict who can insert media.

Sources