A hacker tool called NEMESIS exploits a flaw in the OTA update system of Hyundai and Kia Gen5W infotainment units to unlock features the manufacturer deliberately restricted. The project, published on GitHub under the handle xwtk, targets vehicles from 2015 to 2019. The Hyundai Elantra, Kia Forte, Hyundai Ioniq 6, and all Canadian variants are excluded.
The practical payoff is significant. NEMESIS enables wireless Android Auto and Apple CarPlay, and routes turn-by-turn navigation cues from those apps directly to the driver cluster and heads-up display, a capability previously limited to the inferior built-in OEM navigation. The exploit requires the unit firmware version to contain S5W_M, visible under General Settings, SW Info. Units without OTA support lack the code path needed to run the exploit at all.
The full GitHub repository is worth reading for the version-string targeting logic and the OTA attack surface details, which reveal exactly how much access automakers quietly leave open while locking down the user-facing feature set. This follows prior work on older Hyundai systems and Tesla infotainment, suggesting the pattern of exploitable OTA pipelines is industry-wide, not a one-off.
[READ ORIGINAL →]