CVE-2021-37851: 
NixOS vulnerability analysis and mitigation

A local privilege escalation vulnerability (CVE-2021-37851) was discovered in ESET Windows products' installers. The vulnerability affects multiple ESET products including NOD32 Antivirus, Internet Security, Smart Security Premium, Endpoint Antivirus, and various server security solutions, with versions ranging from 6.0 to specific builds before the patched versions. The issue was disclosed and addressed by ESET on May 9, 2022 (ESET Advisory).

The vulnerability allows a local user to perform a privilege escalation attack by exploiting the repair feature of the installer to execute malicious code with elevated privileges. The vulnerability received a CVSS v3 base score of 7.3 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), indicating high severity. The vulnerability is classified under CWE-755 (NVD).

If successfully exploited, the vulnerability enables a logged-in user to execute code with higher privileges through the repair feature of the installer, potentially compromising system security and gaining unauthorized administrative access (ESET Advisory).

ESET addressed the vulnerability by releasing an automatic update of the Antivirus and antispyware scanner module (version 1587) on March 31, 2022, which was distributed automatically to installed products. Fixed versions include ESET NOD32 Antivirus, Internet Security, and Smart Security Premium version 15.1.12.0, Endpoint products versions 9.0.2046.0, 8.1.2050.0, and 8.0.2053.0, and various server security solutions with their respective version updates. Users with installed products received the patch automatically and required no manual intervention (ESET Advisory).