Authenticated code execution via routingItems concatenation

Stack-based buffer overflow in MBS UBR firmware before 6.0.1.0 allows remote authenticated users to execute code via an HTTP POST request. While processing the ubr-network method, the request parser builds a short string for each user-controlled routingItems element and appends it with strcat to a fixed 0x8001-byte stack buffer without checking the remaining capacity. A valid user or administrator login or session token is required; overflowing the buffer can overwrite the return address and compromise the device.