Automotive cybersecurity has received growing attention in recent years, in part, because security researchers have continued to disclose vulnerabilities affecting transport vehicles. Work by KeenLab, Synacktiv, PCA, GMO and other companies has contributed to this trend, as have security competitions with an automotive focus, including ZDI’s introductory of Pwn2Own Automotive in 2024. Within this context, In-Vehicle Infotainment systems remain especially relevant: they support entertainment, navigation, and connectivity features, while also representing one of the primary attack vectors through which attackers may reach internal vehicle systems.

This talk presents a zero-click, full-chain remote code execution exploit composed of multiple vulnerabilities. The chain first achieves arbitrary code execution within the Bluetooth baseband, then pivots from the baseband environment to the Application Processor, ultimately obtaining root-level execution. The attack can be triggered remotely and does not require any user interaction on the target device. Demonstration of this exploit chain will be made on Volkswagen Transporter T6.1.

The session opens with an overview of Volkswagen T6.1’s IVI system and the target Bluetooth stack architecture before moving into vulnerability discovery and exploitation. It shows how a subtle flaw in MTU window extension leads to a Pool object overflow and an Arbitrary Address Allocation primitive in a custom embedded allocator, then explains how this primitive is converted into stable remote code execution while preserving baseband functionality. The final stage covers the baseband-to-AP (Application Processor) protocol and a buffer overflow that enables a root-level pivot into the AP, resulting in full control of the Head Unit.

Upcoming events

Upcoming events