CVE-2021-25165: 
NixOS vulnerability analysis and mitigation

A remote XML external entity vulnerability (CVE-2021-25165) was discovered in Aruba AirWave Management Platform versions prior to 8.2.12.1. The vulnerability was disclosed in April 2021 (NVD).

The vulnerability involves improper authentication within the authentication process between specified versions of affected systems. If exploited, an attacker could perform a denial-of-service attack by modifying the configuration headers of data in transit. The vulnerability has been assigned a CVSS v3 base score of 6.5 with the vector string (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) (CISA).

A successful exploitation could lead to a drop in wireless capability of affected systems. Network-based services such as pre-populating with infusion parameters through EMR Interoperability or wirelessly updating system guardrails would become unavailable. As a result, operators may have to manually program the system, download data logs, or activate new data sets (CISA).

Aruba has released patches to address this vulnerability in version 8.2.12.1 and later. Recommended mitigations include enabling firewalls with proper rules around port and services restrictions, implementing firewall rules with access control lists (ACL) that restrict access to wireless network segments via specific MAC addresses, operating on secured networks behind firewalls, regular patching, maintaining malware protection, and disabling unnecessary accounts, protocols, and services (CISA).