They won't care about CVE lists. They've heard "security risk" for a decade. You need the language they understand: money and liability.
Start with support costs. If you're paying for an EOL device, your support contract is likely 200% of list price by now. Run the math. Then calculate the mean time to failure for hardware of that age against the business cost of a complete, unscheduled outage. No failover doesn't count if the standby is also EOL.
The hard number is this: your next incident's mean time to repair (MTTR) is now measured in weeks, not hours, because you can't get parts or a support engineer who's seen one of these in five years. Show them the projected downtime cost per hour from the last BIA, then multiply by 168 (a week).
If that doesn't work, show them your firewall can't decrypt TLS 1.3. Your "next-gen" box is blind to 80% of its traffic. That's not a firewall; it's a very expensive router.
Prove it.