Researcher Gains Root on Renault TomTom Navigation Unit to Fix Dashboard Clock

A researcher obtained arbitrary code execution as root on the TomTom Carminat LIVE navigation unit in a 2014 Renault Latitude while attempting to correct the dashboard clock without a legitimate navigation SD card. Reverse engineering uncovered a path traversal vulnerability in the logging functionality of master.script and a restricted command-execution feature that could launch existing binaries without arguments. By combining these capabilities, the researcher modified Linux’s core dump handler and triggered execution of a shell script stored on an SD card, overcoming restrictions imposed by read-only and noexec mounts.

The demonstrated attack required physical insertion of an SD card and confirmation of an execution prompt; the report did not demonstrate a remote attack. After gaining root access, the researcher backed up the unit’s internal storage and changed its timezone setting directly. In a follow-up Reddit comment, the author explained that the system stores a minute offset from GPS-derived time rather than timezone information, and corrected the clock by changing that offset from +180 to +120 minutes. The findings expose a local compromise path in the navigation unit, but do not establish access to other vehicle systems.