Multiple links in the supply chain failed for years to identify an unfixed vulnerability.