Multiple buffer overflow vulnerabilities have been identified in the internet.cgi set_qos() functionality of the Wavlink AC3000 M33A8.V5030.210505 router firmware. These vulnerabilities are triggered via the cli_mac POST parameter in an authenticated HTTP request, potentially leading to stack-based buffer overflows. The CVSS score of 9.1 indicates critical severity with high impact on confidentiality, integrity, and availability.