Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. An authenticated attacker can exploit a command injection flaw in the 'gateway' POST parameter via a specially crafted HTTP request, potentially leading to arbitrary command execution with high impact on confidentiality, integrity, and availability.