Navigation systems with CAN bus connectivity

Volkswagen is selling a navigation system as an optional extra for the new small car, the up!, which connects to the CAN bus. The device is called 'Maps+More'.

I know from the Navigon hotline that it's a Navigon 70 Premium device, but with special software branded for Volkswagen.

The CAN Bus connector is not standard equipment, but is only available on vehicles that have ordered the 'Maps+More' package. The navigation system uses this CAN bus to display the current fuel consumption and engine speed (the 'take up!' does not have a tachometer).

Is it dangerous to connect a device (based on Windows Mobile) whose firmware can be overwritten via USB and which does not have a firewall (Bluetooth) to the CAN bus?

How difficult would it be to retrofit the CAN bus connection?

Since the navigation system can also control the radio, I assume that it is not only able to read data from the CAN bus, but also write to it.

Are my security concerns justified, or am I just imagining things?

To be honest, I'm not entirely sure what you're trying to do.
Do you simply want to control the radio via the CAN interface, or do you want to build an adapter for a standard Navigon device that connects to the CAN bus, or something else entirely?

The navigation system is purchased together with the car.

Is it technically possible for a virus or Trojan to control a car through its navigation system?

It will be difficult to say with absolute certainty, but it is extremely unlikely.