A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.

This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.

The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command.

Response to LIST (forward-slash):

-rw-r--r--    1 ftp      ftp            20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n

By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.

Firmware Tcl L40s6500 -

Navigate to (Gear Icon) > Device Preferences > About . Select System Update . Choose Local Update .

Exact version numbers vary by region and panel. Below are verified examples:

Speeds up the interface and improves app compatibility. firmware tcl l40s6500

The of the firmware you downloaded.

Use this method if your TCL L40S6500 is stuck on the "Android" loading animation, the TCL logo, or displays a black screen but the backlight is on. Navigate to (Gear Icon) > Device Preferences > About

Flashing firmware carries inherent risks. Ensure you complete this checklist to prevent permanent hardware damage:

Firmware plays a crucial role in the functioning of the TCL L40S6500. It: Exact version numbers vary by region and panel

While updating firmware is a software process, the TCL L40S6500 is sensitive to hardware variations. If you have tried multiple firmware versions (V229, V272, V368) and the TV is still stuck on the logo or shows garbled colors, the problem may be hardware-related. Common physical failures on this model include capacitor bursting on the main power supply (TP.S512C.PB772) or a failed T-con board causing screen issues. In these cases, it is time to consult a qualified TV repair technician.

2008-06-15 - Vulnerability Discovered.
2008-06-16 - Vulnerability Details Sent to Vendor via online support form (no reply).
2008-06-18 - Vulnerability Details Sent to Vendor again via online support form (no reply).
2008-06-25 - Vulnerability Details Sent to Vendor again via online support form (no reply).
2008-06-27 - Public Release.