I agree. Cisco should focus on their own CVE vulnerabilities as a top priority. Here are a few hundred to start with: http://www.cvedetails.com/vulnerability-list/vendor_id-16/product_id-19/Cisco-IOS.html