Vulnerability Disclosures

Hi,

I was doing some penetration testing on one of my own devices and noticed said device is subjectable to vulnerability that has been reported for another model of same manufacturer.

It is fixed in newer firmware versions of both models and there is CVE ID given for the vulnerability, but it doesn't have this model listed in "Known Affected Software Configurations". Is this something that should be reported and if it is, how should I progress apart from notifying …

cve cybersecurity device devices disclosures doing firmware manufacturer own penetration penetration testing testing vulnerability