Is Broadcom not obligated to issue a CVE for a legitimate vulnerability?
Since they wouldn't share the contents of their notification to their customers, we don't know how clearly those customers (router makers) were notified. But having a CVE and detection signatures would get this vuln into all the usual scanning and reporting channels, which is another route the customers might (should!) be paying attention to.
Also, I don't know how laws over there work, but there might be legal requirements to patch things once they're known, where "known" is probably defined by "has a CVE issued". So by refusing to issue one, Broadcom is blocking that process.
Since they wouldn't share the contents of their notification to their customers, we don't know how clearly those customers (router makers) were notified. But having a CVE and detection signatures would get this vuln into all the usual scanning and reporting channels, which is another route the customers might (should!) be paying attention to.
Also, I don't know how laws over there work, but there might be legal requirements to patch things once they're known, where "known" is probably defined by "has a CVE issued". So by refusing to issue one, Broadcom is blocking that process.
How is that blameless?