important · Physical — Marine
A crafted microSD card can turn Lowrance and Simrad marine displays into persistently root-controlled systems.
Affects
Lowrance and Simrad marine multifunction displays running Navico NOS; demonstrated on Lowrance HDS Live
Brief access to a powered display's SD slot begins a chain through a file-manager symlink escape, writable dynamic QML, file-scheme XMLHttpRequest and a privileged language-pack traversal.
Detail and 1 source
The demonstrated result is arbitrary root write and lasting root code execution. No vendor acknowledgment or patch was found.
Chain to watch
Use crafted ext4 symlinks to escape the file manager→↓Replace dynamically loaded QML and gain JavaScript execution→↓Rewrite NOS path configuration through file-scheme XMLHttpRequest→↓Abuse the privileged language-pack path for root write and execution→↓The researcher reports success on most tested models, but the exact model and firmware matrix is unknown.
Unverified chainTest the chain on current NOS releases across Lowrance and Simrad model families.