High severity8.1NVD Advisory· Published Mar 19, 2021· Updated Jun 17, 2026

CVE-2021-27221

Description

MikroTik RouterOS 6.47.9 allows remote authenticated ftp users to create or overwrite arbitrary .rsc files via the /export command. NOTE: the vendor's position is that this is intended behavior because of how user policies work

Affected products

Mikrotik/Routeros2 versions
cpe:2.3:o:mikrotik:routeros:6.47.9:*:*:*:-:*:*:*+ 1 more
- cpe:2.3:o:mikrotik:routeros:6.47.9:*:*:*:-:*:*:*
- (no CPE)range: 6.47.9
MikroTik/RouterOSdescription

Patches

Vulnerability mechanics

References

onovy.medium.com/routeros-user-with-just-ftp-policy-can-write-to-filesystem-cve-2021-27221-e3e45d780dfenvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.004
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000