RouterOS uhttpd CGI Shell Injection

The web-based management interface of RouterOS uses a modified uhttpd server with CGI shell scripts.

An unauthenticated attacker with network access can exploit a lack of sanitization in the HTTP Basic Authentication username to execute arbitrary commands with root privileges.