If I read the comments I see: "Cisco originally aimed to get the release of the patch for the 22nd September, however due to testing issues this has been postponed until the 29th which would fall outside of the 90 day disclosure window. Cisco were informed that a grace period exists for this exact situation and they could use it if they requested. However in this case Cisco has declined to use the grace period."

So it sounds like they were aware of the issue, communicated out a fix would be in place but 7 days later than the expiration. Someone didn't want to budge those 7 days and released it anyway.

Not that its a big flaw but it seems a bit inflexible. Companies as large and as old as Cisco don't move very fast..