CVE-2021-26970: 
NixOS vulnerability analysis and mitigation

A remote authenticated arbitrary command execution vulnerability (CVE-2021-26970) was discovered in Aruba AirWave Management Platform versions prior to 8.2.12.0. The vulnerability exists in the AirWave web-based management interface, allowing remote authenticated users to execute arbitrary commands on the underlying host (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. It is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command Injection). The vulnerability affects the web-based management interface and could lead to partial system compromise through command execution with lower privileges (NVD).

A successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands as a lower privileged user on the underlying operating system. This could result in partial system compromise, potentially affecting the confidentiality, integrity, and availability of the system (NVD).

The vulnerability requires network access and valid authentication credentials to exploit. The attack complexity is considered low, requiring no user interaction for successful exploitation (NVD).

The vulnerability has been fixed in Aruba AirWave Management Platform version 8.2.12.0. Users are advised to upgrade to this version or later to mitigate the risk (NVD).