Interesting story but a CVE for this is a bit melodramatic and why no one takes security folk seriously (cry wolf too many times).

OpenWRT ships with no password at all (!) with full root access on default install. The situation is the same: they politely suggest you change it from the default (blank) password but do not force you to do so.

By this logic every OpenWRT install (and many other softwares) dating back many years should be subject to CVE.