CVE are handed out like candy in Java land for artifacts that have code that only opens up a vulnerability when another package is available and the first artif

CVE are handed out like candy in Java land for artifacts that have code that only opens up a vulnerability when another package is available and the first artifact is misconfigured. So I think you would be fully in your right to claim a CVE and list all affected versions of devices/firmwares there.