One thing that is driving up the fucking wall is how CNAs for cve.org just kinda arbitrarily hand out CVEs. Tenda/Totolink: This is the exact same vuln across multiple devices, all using the same base firmware. Better produce a CVE number for every fucking single one of them D-Link: This is a vulnerability affecting FOUR different subsystems invoked by this single CGI file, with 5 different vulnerable parameters. A single CVE number will do.