One has to love their response

"HTC takes our customers' security very seriously, and we are working to investigate this claim as quickly as possible. We will provide an update as soon as we're able to determine the accuracy of the claim and what steps, if any, need to be taken."

Really, they don't even verify it as an issue yet? One of the stories says the people 2who discovered this contacted them

After finding the vulnerability, the trio claim that Eckhart contacted HTC on September 24th and HTC didn’t respond to them. So, after receiving no real response for five business days, they’ve decided to release news of the vulnerability to force HTC to fix the problem.