Re: CVE's for private/"Secret" issues

I understand that such a company does not want to give any information
away about their 0day, as that is a huge part of their reputation (and
thus sales). What I don't understand is that when they release a dozen
exploits for already disclosed issue, they don't match them up with a CVE
if one exists. Why tell people "we can exploit a remote WordPress flaw"
that we know is public, but not which one? As a customer I would certainly
want to know that. But, it may be a case where the actual exploit
references it, and the public list of exploits released in that version /
pack do not. Makes sense for existing customers, but seems like missing
out on potential sales as vague descriptions like that are not very
helpful.

HP's TippingPoint ZDI does use CVE for a majority of their issues, and
they are also very good about answering questions if there is confusion
over assignments or which issue it tracks to in relation to a vendor
advisory. I routinely email them and appreciate their help when it comes
up.

In general, most that I have spoken to consider CVE assignment as either
no benefit, or possibly hurting them competitively. Further, from their
eyes, what is the value if they have no plans to ever release details, and
never verify it is a duplicate to another disclosure?