From Plug-and-Play to Over-the-Air Pwnage: Why the Herilary C-4 CarPlay Hack is a Wake-Up Call for the EU Cyber Resilience Act

Cybersecurity Insight Report

Wireless Apple CarPlay has become a coveted feature for modern drivers, leading to a booming market for aftermarket USB dongles that bridge the gap for older infotainment systems. However, the convenience of untethered connectivity often masks alarming security oversights.

A recent dive by security researcher Louis Erbkamm into the $50 “Herilary C-4” CarPlay dongle—highlighted in the IT4Sec cybersecurity newsletter—exposed a catastrophic chain of vulnerabilities. In a matter of hours, Erbkamm demonstrated how a local attacker could achieve a zero-click, over-the-air compromise, securing a persistent root shell in under a minute.

Beyond being a fascinating technical case study, this research serves as a glaring example of why the European Union’s impending Cyber Resilience Act (CRA) is not just bureaucratic red tape, but an absolute necessity for consumer safety. Here is a deep dive into the anatomy of the attack and why devices like this will soon face a harsh legislative reckoning in the European market.

The Anatomy of the Attack: Over-the-Air Firmware Hijacking

The Herilary C-4 operates as a standard embedded Linux system running on an Allwinner V831 SoC. To communicate with an iPhone, the dongle broadcasts its own Wi-Fi Access Point. The security unravels almost immediately from there.

1. The Front Door is Wide Open

The initial attack vector requires no sophisticated cracking. The device broadcasts a Wi-Fi network secured by a globally hardcoded, unchangeable password. Any individual physically close to the vehicle can look up the default credentials online and connect to the dongle’s network.

2. Unauthenticated Web Interfaces

Once on the network, an attacker can access the dongle’s local web interface, which is used for over-the-air (OTA) updates and log management. Erbkamm discovered that this interface features absolutely zero authentication. Any client on the network can interact with the Common Gateway Interface (CGI) endpoints.

3. The Illusion of Firmware Integrity

By analyzing the device’s update mechanism, the researcher found that the firmware package (an SWUpdate format) is entirely unencrypted. More critically, the device does not enforce cryptographic signature verification (such as secure boot or signed OTA updates). The only integrity check is a rudimentary MD5 checksum—a hashing algorithm that an attacker can easily recalculate.

4. Achieving Root

Because the firmware is unauthenticated, Erbkamm was able to extract the firmware, modify the internal Linux filesystem, and inject a custom CGI web shell into the startup scripts. After repacking the firmware and recalculating the MD5 hash, a single `curl` command was all it took to push the malicious update to the dongle.

The device happily accepted the file, flashed itself, and rebooted. Because the dongle lacks privilege separation and runs all services as `root` (UID 0), the injected web shell granted the attacker immediate, persistent, and unauthenticated administrative control over the device.

A Chamber of IoT Horrors

The root shell was just the tip of the iceberg. The teardown revealed a litany of negligent engineering practices:

• Hardcoded Cloud Credentials: The firmware contained hardcoded Alibaba Cloud access keys used to upload user diagnostic logs (including MAC addresses and system data) to servers in China—without a privacy policy or user consent.
• No Network Filtering: The device lacks iptables or any basic firewall. Every service listens on 0.0.0.0, exposing a dozen TCP ports to anyone on the Wi-Fi network.
• Trivial Passwords: A crackable DES-hashed default root password sat in the /etc/shadow file.
• Counterfeit Hardware: The device utilized counterfeit Apple MFi (Made for iPhone) authentication chips, posing both security and legal risks.
• No Disclosure Path: The brand “Herilary” is a white-label entity with no reachable security contact, making responsible vulnerability disclosure impossible.

Enter the EU Cyber Resilience Act (CRA)

For years, the IoT and consumer electronics markets have operated on a “ship-it-and-forget-it” mentality. The EU Cyber Resilience Act (EU 2024/2847), which entered into force in late 2024 with strict enforcement deadlines approaching in 2026 and 2027, is designed to end this exact paradigm.

If the Herilary C-4 were assessed under the incoming CRA mandates, it would fail spectacularly across multiple essential requirements:

1. Security by Design and Default

The CRA outlaws the use of universal default passwords. Under the new regulation, devices must require users to set a unique password upon initialization, or ship with unique, randomized credentials per device. The C-4’s unchangeable Wi-Fi key is a direct violation of this mandate. Furthermore, the CRA dictates that devices must be designed to minimize their attack surface. Running all embedded services as `root` and lacking a local firewall violates the core principle of least privilege.

2. Secure, Authenticated Updates

The CRA explicitly demands that products with digital elements must ensure the integrity and authenticity of software updates. The days of relying on a bypassable MD5 checksum are over. Manufacturers will be legally required to implement cryptographic signatures (like asymmetric key pairs) to ensure that only legitimate, manufacturer-approved code can be flashed to a device.

3. Vulnerability Handling and Disclosure

Erbkamm’s inability to find a vendor contact highlights a massive systemic issue. Under the CRA, vulnerability management is no longer optional. Starting in September 2026, manufacturers must:

• Maintain a clear, public point of contact for security researchers.
• Document a formal vulnerability handling process.
• Report actively exploited vulnerabilities to the European Union Agency for Cybersecurity (ENISA) and national CSIRTs within 24 hours of discovery.

White-label distributors will no longer be able to hide behind anonymous supply chains; the entity placing the product on the EU market bears the legal responsibility.

4. Data Protection and Privacy

The automated exfiltration of device logs to cloud storage via hardcoded API keys without user consent blatantly violates the CRA’s requirement to protect the confidentiality of stored and transmitted data. Devices must ship with data protection enabled by default, ensuring that telemetry is secure, transparent, and opt-in.

The Bottom Line

The Herilary C-4 is a perfect microcosm of the broken state of consumer IoT. When drivers plug a cheap dongle into their cars, they unknowingly invite an open, vulnerable Linux server into their vehicle’s local network.

The EU Cyber Resilience Act represents a seismic shift in accountability. With penalties for non-compliance reaching up to €15 million or 2.5% of global annual turnover, manufacturers can no longer afford to treat security as an afterthought. Erbkamm’s research proves that the barrier to exploiting these devices is dangerously low. Thanks to the CRA, the legal barrier for selling them is about to become insurmountable.