As someone who has to respond for this kind of stuff at work, I am regularly in a situation where I am pushing back on a CVE, or telling them that our product neither uses nor installs that package (or its for a different OS entirely).

Our product is run in a moated environment, most systems have the same username and passwords (customers never change the defaults), so I only really care about RCE's even if it is an effected package.

> most systems have the same username and passwords (customers never change the defaults)

That is horrifying and 100% on your dev team. You should not ship default credentials, instead require unique creds to be set at install. Ship an update which required default creds to be changed.

Who do you think you are, Cisco?