“It is a little less known that if n is 0, the result of the strncmp function is also 0.”
RIGOL’s MSO5000 web interface writes your new password by shelling out to echo, so a semicolon in the password field runs any command you like. The old-password check compares only as many characters as you send, and sending none passes. Romei reported it in November 2022, got two promises of updates, and went to full disclosure in February. One curl command owns a lab instrument.