An appliance is suffering from "cryptographic bad practice"-class of problem, more details here. It would take quite some person-months to prove just for one firmware version if it can be exploited.
My questions are:
How can "bad practice"-class problems be reported without someone developing the exploit?
If you think it can be pushed through 1st level customer support, what arguments should be used?
"I think what you do is bad practice, please spend money fixing it, even though it may be harmless"