Software gets all the attention. But end-of-support-life hardware creates the same CVE blind spot — with no patch path and no scanner that flags it. Here's what you need to know.