How to obtain Cisco IOS firmware?
Cisco IOS upgrades that include security fixes are available publicly regardless of support contract, it's just a major pain to get them. If the version you want contains a security fix, you're in luck.
Enter your version of IOS here, and the list of patched vulnerabilities will come up. Select one (for example), and under "Obtaining Fixed Software", there's instructions on putting in a TAC ticket to get the firmware that's fixed the vulnerability.
Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC.
They aren't kidding about this part; last time I needed to do this, I had to quote that line twice to technicians who wanted to close to ticket due to lack of support contract.
As far as I know you need a Cisco support contract to download firmware from Cisco. Any firmware you find outside the Cisco support pages is most likely not distributed according to the EULA of the firmware.
Welcome to the world of industrial class hardware. The service agreement is usually more expensive than the hardware.