No deadlines, no on legislation.
Why would they be?
You have found a vulnerability, reported.
Then what do you want?
The company took note.
What more do you want?
to stimulate its elimination?
As you can stimulate its elimination?
Why did you decide that it will be fixed?
Purely human, if you tell me that in my office, the window is not closed, and through it can get an attacker - I say thank you
If you then will walk and wonder - why is it still not closed, I very impolite to say that it is generally none of your business
According to the law to know that such information is not prohibited, you can share it too, is not prohibited.
Although if you're trying to climb in an open window, or will someone instigate this, then it is a punishable act.