Ask HN: What to do when a vendor doesn't respond to security issues?

A user investigated the firmware of an internet-connected appliance at home and discovered it was vulnerable to a known issue due to being outdated. The user found an unauthenticated service reachable from the local area network that had a known vulnerability allowing arbitrary file reads on the device, as well as another vulnerable endpoint. The vendor claims the product is still supported, but the latest firmware build is years old. The user's goal was to report the vulnerability to prompt the vendor to release an updated firmware with improvements. However, the issue at hand is the vendor's lack of response to security issues. The user is seeking advice on how to proceed in this situation.