GLM finds trivial full RCE in a car head unit via debuggable system app and JDWP
ngxson · x · 2026-10-25
The author asked GLM-5.3 to audit their car's head unit, and the verdict: full RCE, trivially.
The chain, demonstrated live on the unit:
- com.carletter.car, the wireless CarPlay/ZLink client, is a system app running as uid 1000 with android:debuggable="true", exposing a JDWP debug interface;
- adb jdwp → PID → adb forward tcp:8000 jdwp:<pid>, then attach a JDI client;
- set a breakpoint on Handler.dispatchMessage, catch the event, and invoke Runtime.getRuntime().exec(...) for arbitrary command execution as system.
Proof artifacts on the unit include settings get system rcepoc returning pwnedbyjdwp, plus /data/rcepocuid1000 and /sdcard/rcepoc. The author notes it's "worse than it sounds."
More from Models
- Community org claims to run "DeepSeek v4.1 flash" locally via pruning — unverified — amplifiedamp · 2026-10-25
- Kimi K3.1 disappoints: analysts say Moonshot trails DeepSeek on RL progress — scaling01 · 2026-10-25
- GPT-6.1 Sol beats Opus 5.5 on cost-performance balance, argues dev who caught Opus in logic traps — haider1 · 2026-10-25
- Abliterated DeepSeek V4.1 Flash GGUF hits Hugging Face trending — orcarouter · 2026-10-25
- DeepSeek open-sources its production inference engine for V4.1 Flash, runs on Blackwell and Ascend — altryne · 2026-10-25
- KLD Is Misunderstood: Why It Can't Rank Quantized Models Reliably — Positive-Resource922 · 2026-10-25