That is completely untrue. You can open a case and get access to downloads outside your support contract if you reference a vulnerability that’s affecting your current hardware.
Ok, but that's bullshit, isn't it? Not all customers are going to be proactive/attentive enough to know their hardware is vulnerable. Cisco knows there is vulnerable gear in the wild, knows there is a fix, but withholds the fix until people come begging? Almost feels like the sort of thing that should be illegal (or at least on the losing end of a civil suit).
Of course Microsoft also released some free security updates beyond the date too.
Please go on and let me know where I can open this case.
I am not sarcastic, I really need that fixed.
Most security-critical devices are moving in the direction of auto-updating. I'm not super into that, but I see the justification. You're telling me that Cisco is so far in the opposite direction that if I want to patch a device, I can't download the firmware myself, I have to open a service request saying, "I'd like the latest security patches", and then answer the question, "Why? What specifically are you worried about?"
That is not the setup of a company that cares about security.
Putting firmware patches behind any kind of account authentication is mind-boggling to me. I wouldn't have guessed that there's a hardware company that does that.
Holy crap does anybody actually think that's remotely acceptable behavior? I get better support on discounted Chinese routers I've bought in back alleys - they at least put out their patches for free.