Provide the CVE or it doesn't exist.

A vulnerability of this magnitude would have a CVE. Responsible Disclosure guidelines *strongly* prefer that you disclose vulnerabilities to the vendor before notifying the public. This gives the vendor a chance to fix the problem before it becomes more widely known to the hordes of script kiddies. The timeline of this fix depends on the severity of the problem and the number of attacks out there in the wild.

In addition, this procedure reduces the change of a security researcher making a mistake. Cisco can issue CVEs, so why didn't it do so in this case? If normal Disclosure guidelines are not followed, then it feels like the author is trying to gain their 15 minutes of fame by making big claims.

Please don't go spreading rumors with vague information on a Friday afternoon.