The question is who put them there... and more interestingly, do the updates replace the backdoors with different, more hidden ones?
To put it bluntly, even backdoor accounts need their credentials changed once in a while.
To put it bluntly, even backdoor accounts need their credentials changed once in a while.
Finding those only to replace them with a more elaborate bug seems to be ill intent and unlikely for me. The bigger problem IMO is that the mentality above is still prevalent: for every two backdoors found a new one may be put in by another do-gooder.
I'm sure it is mostly incompetence, with only the occasional state-actor poisoning the well. But I see little evidence Cisco gives a damn or has any intention of actually attempting to regain some of the squandered trust.
Which is fine, from my perspective; for the most part I like other vendors' kit quite a bit more anyway.
I do think product liability law needs to kick in somewhere. If you have some Tourettes-like inability to stop writing back doors in security products, there should be some outside pressure to maybe get some help.