Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. These vulnerabilities allow an authenticated attacker to execute arbitrary commands on the device by sending a specially crafted HTTP POST request, specifically exploiting the 'dest' parameter.