| vuln.sg Vulnerability Research Advisory |
by Tan Chew Keong 
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system. The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command. An example of such a response from a malicious FTP server is shown below. Response to LIST (forward-slash): -rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below. Alps Android -Below is a guide for managing and troubleshooting an Alps-based Android device. 1. Identifying Your Specific Hardware : Download an app like CPU-Z or DevCheck to find your specific MediaTek processor model (e.g., MT6762) and board ID [35]. that supplies roughly 40,000 types of components to over 2,000 manufacturers, including giants like Samsung, Motorola, and Apple. Industrial Presence +-------------------------------------------------------+ | App Layer (System Apps, Launcher, Settings) | +-------------------------------------------------------+ | Android Framework (MediaTek Custom Extensions) | +-------------------------------------------------------+ | HAL (Hardware Abstraction Layer - Camera, Audio, GPS) | +-------------------------------------------------------+ | Kernel Space (MediaTek Driver Modules & ALPS Patches) | +-------------------------------------------------------+ alps android In the developer world, stands for "Android Live Wallpaper Practical Solution." When a factory wants to create a cheap, generic Android device, they do not build the operating system from scratch. Instead, they purchase a MediaTek processor and download the matching . The White-Label Ecosystem Ensure the device has a microSD card slot for expanding storage, as internal storage on these devices can be unreliable. 5. Conclusion: Is ALPS Android Right for You? Below is a guide for managing and troubleshooting If you are looking to modify the device (rooting or flashing), proceed with extreme caution as these devices are easily "bricked." The keyword "Alps Android" represents a fascinating paradox. On one hand, it is the engine of democratization in technology, allowing a factory worker in Dongguan to afford a smartphone. On the other hand, it is the Wild West of mobile security—a place where userdebug backdoors, unpatched exploits, and pre-installed malware run rampant. Alpine manufactures premium in-dash head units (car stereos) that are designed to interface seamlessly with Android smartphones. High-end models like the come with built-in support for both Apple CarPlay and Android Auto . This allows users to project their phone's essential apps—maps, music, messages—onto the large, vibrant screen of the Alpine unit. that supplies roughly 40,000 types of components to "Alps Android" typically refers to the generic device firmware (ROM) used by based smartphones, often labeled as "alps" in system information [33, 35]. This is not a formal consumer brand but a common internal identifier for many budget-friendly, white-label, or "clone" Android devices [35]. : These devices are built for value. While you won't be winning any speed contests against a flagship, they handle everyday tasks like WhatsApp, Facebook, and light browsing surprisingly well. The "Hacked" Software Quirk Because "Alps" appears as a default system name for many generic MediaTek-based phones, it has become synonymous with the Chinese "clone" market ALPS Android Guide: What to Know About Budget Phones, Tablets, and Head Units in 2026
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered. |
| Contact |
| For further enquries, comments, suggestions or bug reports, simply email them to |