Multiple OS command injection vulnerabilities exist in the sch_reboot() functionality of the adm.cgi component in Wavlink AC3000 M33A8.V5030.210505. These vulnerabilities can be triggered by an authenticated attacker via specially crafted HTTP requests, specifically through the restart_week POST parameter, leading to arbitrary code execution on the device.