Multiple buffer overflow vulnerabilities have been identified in the qos.cgi qos_settings() functionality of the Wavlink AC3000 M33A8.V5030.210505 router firmware. These vulnerabilities can be triggered by an authenticated attacker sending a specially crafted HTTP POST request with the qos_dat parameter, leading to a stack-based buffer overflow. The vulnerabilities have a high severity with a CVSS score of 9.1, indicating critical impact on confidentiality, integrity, and availability.