Hacker News Reader

I don't think you understand, "password123!" was the password the researcher set.

In the CVE, it details the call it executes to retrieve the password from nvram.

Ahh I misread. Even still. Directly injecting the password in the source of a JS file for the purposes of checking authentication? That screams naive error to me.

Reply on news.ycombinator.com