I bet more than one US three-letter-agency knew about that vulnerability for ages, but kept it under wraps instead of reporting it to get it fixed.