CVE-2021-27221: MikroTik RouterOS

High severity, CVSS 8.1. EPSS: 4.7% chance of exploitation in the next 30 days.

MikroTik RouterOS 6.47.9 allows remote authenticated ftp users to create or overwrite arbitrary .rsc files via the /export command. NOTE: the vendor's position is that this is intended behavior because of how user policies work

Affected products

• MikroTik RouterOS: version 6.47.9 only

Published 2021-03-19. Last modified 2026-06-17.