Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. An authenticated attacker can exploit these flaws by sending specially crafted HTTP requests, particularly via the netmask POST parameter, to execute arbitrary commands on the device. The vulnerabilities have a high severity score of 9.1 CVSS v3.1, indicating critical impact on confidentiality, integrity, and availability.