Unidade de navegação TomTok do Renault… · Public exploit code

Researcher gains root on Renault Latitude 2014 TomTom GPS

Nov 04, 2026 · 1 min read

Researcher Rasmus Moorats gained root on the TomTom navigation unit of his 2014 Renault Latitude, which runs Linux 2.6.28, using a path traversal bug in master.script on the SD card to point the kernel's crash handler at his own script; the goal was fixing the clock after daylight saving time ended. The flaw requires physical access to the vehicle and the driver tapping Yes on an "Execute master.script?" prompt. No fix has been disclosed in the sources.

By HIFY Radar newsroom Updated 11/04/2026 04:33 PM Get this every day →← Back to the feed 1 source

LowVulnerabilityPublic exploit codeFix unconfirmed

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A researcher gained root access on the TomTom navigation unit of his own 2014 Renault Latitude. His goal was fixing the car's clock, which the unit would not let him adjust after daylight saving time ended. The technique relied on a flaw in a file on the SD card.

Why it matters

The case shows a vehicle head unit can be fully taken over through an SD card. On the affected model, risk is low: the flaw requires physical access to the car and the driver confirming a screen prompt. No fix has been disclosed.

What to do

No fix or mandatory action is indicated in the sources. If the fleet runs the 2014 Latitude, tell drivers to refuse unexpected script-execution prompts. Monitor Renault statements.

For the technical team

Affected: Unidade de navegação TomTok do Renault Latitude 2014 (Linux 2.6.28) · TomTom navigation unit in a 2014 Renault Latitude, running Linux 2.6.28 (researcher's report about his own car).
Exploitation: Working proof of concept by researcher Rasmus Moorats on his own vehicle, reported by @IntCyberDigest. No reports of malicious exploitation.
Fix: No fix disclosed in the sources.
Vector: Path traversal in master.script, a file on the unit's SD card. The researcher pointed the kernel's crash handler at his own script and deliberately crashed a program; the kernel ran the script as root. Exploitation requires physical access and the driver tapping Yes on an "Execute master.script?" prompt.
More details: Motive: the clock could not be adjusted after daylight saving time ended. The researcher said he did not even want the maps: "I just want to change the damn time."