12 weeks after critical vulnerability was patched, devices are still being wrangled.