They were apparrantly working on a patch. The interesting question is whether they had reason to assume the software was compromised. If so, they should have informed their customers.
The article says they were working on a patch because they were told about the vulnerability by the Dutch Institute for Vulnerability Disclosure (DIVD).