Understand, although you buy hardware, Cisco doesn't really sell their software, they license its usage to you under a set of conditions. Some of those conditions often address what your entitlements are for software revisions.
That said, for the Cisco equipment I've worked with, I've understood many maintenance updates require the device to be covered by a maintenance contract unless the software already has some kind of explicit upgrade allowance already attached to it. For example, I recall, when the 3750s first came on the market, they had "lifetime" software maintenance although I also recall, several years later, Cisco changed that. (The initial allowance was because the 3750 was also marketed to SMBs, and other vendor SMB marketed devices often have such maintenance provisions.)
For software that does require a maintenance contract, and if you don't have that, one exception to a legal update that I'm aware of, Cisco often allows upgrades to certain specific releases that address major security flaws.
Another "exception" is if you "buy" a current release software but without buying maintenance.
For a truly definitive answer, for a specific case, probably best to contact Cisco for an answer. Getting this wrong can be a rather expensive mistake.
