I have to disagree - not one of those CVE is about using a SHA-1 hash in a self-signed cert. Like MD5, SHA-1 has been superseded because of increasing computing power. All those CVE are already fixed in your code release through CSCvb48603 so that's how you can tell they are not related - if they were it would be fixed already.
Apologies if you think I'm being aggressive but what you're asking for amounts to a feature enhancement on a product which is long past end of sale, and most of the following milestones, and nearly at total end of support. We all know that features and functionality don't get updated in old products - so it's expected that you will encounter these sorts of issues when you keep running equipment beyond those dates. We all do it sometimes but you then have to accept the risk that that entails.
If you need to mitigate it then you ensure (through firewall) that only authorised, trusted devices can connect to that port on the WLC or you use CPU ACL to block all traffic on that port. Ultimately you have to conduct an intelligent risk assessment of these pen-test findings and mitigate as appropriate to your environment. If the security folks don't accept that then your only option is new kit and somebody has to find the budget for that. That's when they will sometimes reconsider reasonable mitigations.
