Martin,
With all due respect, you appear to continue to defend the indefensible. It's almost like you work in sales rather than engineering or support - oh wait, you do. How can you claim it's not been ignored. The proof is the 8 firmware releases Cisco has made without fixing a very annoying bug and your article claims it only started with the most recent firmware. Cisco chooses not to fix severe vulnerabilities in supported products too. I've had too many clients just decide they're done with Cisco because if it can't be trusted to acknowledge and fix simple problems that are years old and also can't be trusted to fix severe vulnerabilities on supported switches simply because it'd rather sell new switches than fix old ones, they're just not going to give Cisco their $ any more. We have a 40+ site client now not looking at Cisco at all. We can't be the only ones seeing clients move on.
You're assumption that it doesn't affect a large number of customers really makes me scratch my head. It literally affects EVERY SINGLE CUSTOMER who has one of these and I've never met someone who's used or owns one hasn't experienced it. Now, do they call Cisco or chime in in your forums? Maybe not, but have you considered that could be because things don't get fixed so why bother?
As for criticality, that's very subjective isn't it? Is it a security vulnerability? It could be. When customers choose to use simple passwords because they have to be reentered all the time it is. Is it costing customers money? Absolutely because every time you get kicked out you have to log back in and drill back down to where you were and for many small businesses $ is more important, whether it should be or not, to their owners than other security risks. I just fear you don't understand the small business owner mindset as well as you perhaps could.
