Oncord+ Android Infotainment System ADB Port Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in Oncord+ Android Infotainment Systems running Android 12, Model TS17, Hardware part Number F57L_V3.2_20220301, and Build Number K24-2023/05/09-v0.01. The issue arises from improper access control on the ADB port, allowing attackers to execute arbitrary code remotely.

Impact

Exploitation of this vulnerability grants root access to the infotainment unit.

Reproduction

The vulnerability can be reproduced by accessing the ADB port on the affected device. This can be done by connecting the device to a computer and using ADB commands to execute arbitrary code. The exploitation process may involve uploading a malicious script that creates a persistent backdoor on the device.