CVE-2021-27221

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-27221
MikroTik RouterOS 6.47.9 allows remote authenticated ftp users to create or overwrite arbitrary .rsc files via the /export command. NOTE: the vendor's position is that this is intended behavior because of how user policies work

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

8.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:S/C:N/I:C/A:C

Exploitability : 8.0 / Impact : 9.2

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
https://onovy.medium.com/routeros-user-with-just-ftp-policy-can-write-to-filesystem-cve-2021-27221-e3e45d780dfe Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:o:mikrotik:routeros:6.47.9:*:*:*:-:*:*:*
History

07 Nov 2023, 03:31

Type Values Removed Values Added
Summary ** DISPUTED ** MikroTik RouterOS 6.47.9 allows remote authenticated ftp users to create or overwrite arbitrary .rsc files via the /export command. NOTE: the vendor's position is that this is intended behavior because of how user policies work. MikroTik RouterOS 6.47.9 allows remote authenticated ftp users to create or overwrite arbitrary .rsc files via the /export command. NOTE: the vendor's position is that this is intended behavior because of how user policies work
CWE CWE-77 NVD-CWE-noinfo

26 Mar 2021, 01:40

Type Values Removed Values Added
CPE cpe:2.3:o:mikrotik:routeros:6.47.9:*:*:*:-:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : 8.5
v3 : 8.1
References (MISC) https://onovy.medium.com/routeros-user-with-just-ftp-policy-can-write-to-filesystem-cve-2021-27221-e3e45d780dfe - (MISC) https://onovy.medium.com/routeros-user-with-just-ftp-policy-can-write-to-filesystem-cve-2021-27221-e3e45d780dfe - Exploit, Third Party Advisory
CWE CWE-77

19 Mar 2021, 03:48

Type Values Removed Values Added
New CVE
Information

Published : 2021-03-19 03:15

Updated : 2024-04-11 01:10

NVD link : CVE-2021-27221

Mitre link : CVE-2021-27221

CVE.ORG link : CVE-2021-27221

JSON object : View

Products Affected

mikrotik

  • routeros
CWE
NVD-CWE-noinfo