[Android Q&A, Help & Troubleshooting] Martarek:
I've been thinking about this for a while now and talking to people in private about this. First thing though, keep in mind that Honda does not mean for you to fiddle with your car radio outside the normal working parameters, first to protect their product and second to protect you. A car radio is hooked onto your car and it is pretty daring to want to play with it. Translation : it may (or not!) very well end up with a surprise visit to the dealer for a radio reset with an expensive tab and voiding your warranty in the process. Also, I do not have a Honda car and therefore cannot test any ideas I propose. My suggestions are only based on my experience with other Android systems and a fair background on exploits. Anything you try is entirely at your own risks! The following is purely for educational purposes. You have been warned =) .

The disclaimer being done, here goes! At first, my thoughts were to use the WebView vulnerability mentionned here

https: //cyberarms.wordpress.com/2014/02/26/android-webview-exploit-tutorial-70-of-devices-vulnerable/

In order to get into the system (get a remote shell on the device). However, this is effectively patched in the 4.2.2 browser, so tough luck. Unless an App on the device use the deprecated webview component, it should not be exploitable this way.

However, there might be other vectors. For instance, a better bet would be leveraging the Stagefright exploit if it is not patched. Long story short, it's an exploit based on a vulnerability from the media playing library called Stagefright that lit the media recently. Any Android version older than 5.1 is supposedly vulnerable. The proof-of-concept was released by Zimperium here :

https ://blog.zimperium.com/the-latest-on-stagefright-cve-2015-1538-exploit-is-now-available-for-testing-purposes/

It has been tweaked by Google and released on exploit-db here :

https ://www.exploit-db.com/exploits/38226/

To be honest, it's not an easy task to get a perfectly crafted video that exploits this bug. However it is possible to see if the device IS vulnerable. Basically the test to do would be to generate a video using the python script provided in the Zimperium link (the details for generating the video (various offsets, remote server address and port, etc.) is irrelevant at this stage; input anything). Then, this video would need to be served locally (a little Apache server on a PC that you own on your local network would do it). From there you could access the video URL on your network from your car radio. The browser will most assuredly be unable to read the video because the format is (willingly) corrupted to exploit the buffer overflow in the library. It may restart or be killed by the system because it tried to access an unexepected memory location. On standard phone devices which I have tried it, no lasting damage was done by this test (worst case it having the need to restart the browser). However, from the debugger logs (accessible from some sub-menus in the dev mode of the radio), if you see a SIGSEV crash report with a bunch of memory locations being dumped, it means that the radio could be exploited through Stagefright and possibly obtain a root access. If so, it could be plausible (but not easy) to obtain a remote shell onto the device using this vector.

As setupping an Apache server is a little off-topic, I'd recommend a quick Google search on own to setup Apache or simply host the file on any file hosting service you want (a small FTP server could be enough).

The APK vector could be interesting as well if instead of installing a standard Android application you were to install a service application. Some application like Drozer are meant for pentesting on Android platforms and possess a so-called "rogue-agent" which is an APK that installs as a service and gives a remote shell handle for connecting to a device. In this case, if it installs, it could be used to gain control of the device. Drozer can be found at the website below and on various pentesting distros (e.g. Santoku).

https:/ /www.mwrinfosecurity.com/products/drozer/

Finally, if someone you scan the device for open ports (say a port mapping with nmap and/or a Wireshark/TcpDump traffic trace) it could also lead to knowing what else runs onto the device and what is useful. Anyways, anybody knows what comes up if you try to reach from a Web browser the address http://<yourcaripadress>:80 when the car is logged onto your network?

Again this is all based onto the assumptions that the Linux Kernel isn't TOO modified, that the processor's architecture is ARM-based, and much more. In short, it's a plausible very long shot =) . So that's that for the moment.

Sadly, I can't help you there... As I said, I do not own one of those. The timeframe of your warranty might still be valid and they might be willing to help you out at your dealer's garage... My Google-Fu did not manage to find an answer to your problem, sorry!