A security flaw in certain HTC Android builds allows third-party applications to access WiFi passwords. The flaw was discovered last September by Chris Hessing and Bret Jordan, who contacted HTC privately before publicly disclosing details.
Considering the list of affected devices – which includes the Desire HD, Glacier, Droid Incredible, Thunderbolt, Sensation, Desire S, EVO 3D and EVO 4G – it appears that the bug is related to some HTC-specific Android modifications in its custom Sense UI. The myTouch 3G and Nexus One, which both run stock Android software despite being manufactured by HTC, do not have this issue.
Since being informed of the security flaw, HTC has already incorporated fixes into regular OTA updates for “most” devices, though we do not know which ones. For those devices that haven’t gotten an automatic fix yet, HTC will provide a manual fix next week, as a statement on its support site reads:
HTC has developed a fix for a small WiFi issue affecting some HTC phones. Most phones have received this fix already through regular updates and upgrades. However, some phones will need to have the fix manually loaded. Please check back next week for more information about this fix and a manual download if you need to update your phone.