CVE-2021-27221
📋 TL;DR
CVE-2021-27221 allows remote authenticated FTP users in MikroTik RouterOS to create or overwrite arbitrary .rsc configuration files via the /export command. This affects MikroTik RouterOS systems with FTP access enabled and users granted FTP policy permissions. The vendor considers this intended behavior due to user policy design.
💻 Affected Systems
- MikroTik RouterOS
📦 What is this software?
Routeros by Mikrotik
⚠️ Risk & Real-World Impact
Worst Case
An attacker with authenticated FTP access could overwrite critical system configuration files, potentially leading to complete system compromise, service disruption, or persistent backdoor installation.
Likely Case
Malicious or compromised users with FTP access could modify router configurations to redirect traffic, disable security controls, or create persistent access mechanisms.
If Mitigated
With proper user access controls and FTP service disabled for untrusted users, the risk is limited to authorized administrators who already have configuration privileges.
🎯 Exploit Status
Exploitation requires valid FTP credentials with appropriate permissions. The vulnerability is well-documented with public proof-of-concept details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
No official patch available as vendor considers this intended behavior. Upgrade to latest RouterOS version and review user policies.
🔧 Temporary Workarounds
Disable FTP Service
allCompletely disable FTP service if not required for operations
/ip service disable ftp
Restrict FTP User Policies
allReview and restrict FTP permissions to only trusted administrative users
/user set [find name=username] ftp=no
🧯 If You Can't Patch
- Implement strict network segmentation to isolate RouterOS management interfaces
- Enable detailed logging and monitoring of FTP access and configuration changes
🔍 How to Verify
Check if Vulnerable:
Check if FTP service is enabled and users have FTP permissions: /ip service print and /user printCheck Version:
/system resource printVerify Fix Applied:
Verify FTP service is disabled or users lack FTP permissions using the same commands📡 Detection & Monitoring
Log Indicators:
- FTP authentication logs from non-admin users
- Unexpected .rsc file creation/modification in system logs
- Configuration export commands via FTP
Network Indicators:
- FTP connections to RouterOS management interfaces
- Unexpected configuration file transfers via FTP
SIEM Query:
source="routeros" AND (event="ftp-auth" OR event="file-write") AND user!="admin"