CVE-2021-25166: 
NixOS vulnerability analysis and mitigation

A remote unauthorized access vulnerability (CVE-2021-25166) was discovered in Aruba AirWave Management Platform versions prior to 8.2.12.1. The vulnerability was disclosed in April 2021 and affects the platform's security controls (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 HIGH with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. It is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The vulnerability allows remote attackers with low privileges to potentially execute arbitrary commands on the affected system (NVD).

If exploited, this vulnerability could allow attackers to gain unauthorized access to the system, potentially leading to complete compromise of confidentiality, integrity, and availability of the affected AirWave Management Platform (NVD).

The vulnerability requires low attack complexity and can be exploited remotely by an attacker with low privileges. No user interaction is required for exploitation (NVD).

Aruba has released patches for AirWave Management Platform that address this security vulnerability. Users are advised to upgrade to version 8.2.12.1 or later to mitigate this vulnerability (Vendor Advisory).