Security research on Volkswagen MEB/MIB ICAS3 and ICAS3GP infotainment (Samsung V700 / V700F31): AGL + QNX + Android under a hypervisor.

Finding: inserting a USB stick causes the unit to auto-run lg.sh as root via RunAutoHmiUpdate — no signed update package required. From that foothold you can root the AGL guest, pivot to the QNX host, reach the Android VM over internal TCP/UDP bridges, and extend toward vehicle-connected domains.

Timeline: found early 2022; tested on ICAS3 (2022–2023) and ICAS3GP (late 2023–early 2024). Works on production units with secure boot enabled and is valid across software versions, from the older 1516 releases through the latest 3001 release.

Full write-up, UART log, hardware photos, PoC video, and script:
https://github.com/ztecjo/vw-mib-icas3-icas3gp-platform-root

Author: Saif Alzyoud — https://www.ztecjo.com — https://www.alzyoud.org