What’s Vulnerable › Vulnerabilities

CVE-2021-27221

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-03-19 · updated 2026-06-17

Description

MikroTik RouterOS 6.47.9 allows remote authenticated ftp users to create or overwrite arbitrary .rsc files via the /export command. NOTE: the vendor's position is that this is intended behavior because of how user policies work

Affected products

• MikroTik RouterOS: 6.47.9

References

• https://onovy.medium.com/routeros-user-with-just-ftp-policy-can-write-to-filesystem-cve-2021-27221-e3e45d780dfe
• https://onovy.medium.com/routeros-user-with-just-ftp-policy-can-write-to-filesystem-cve-2021-27221-e3e45d780dfe

Get alerted when CVE-2021-27221 or the next vulnerability affects your stack