Multiple OS command injection vulnerabilities exist in the sch_reboot() functionality of the adm.cgi component in Wavlink AC3000 M33A8.V5030.210505. These vulnerabilities can be triggered by an authenticated attacker sending a specially crafted HTTP request, specifically exploiting the restart_hour POST parameter, potentially allowing arbitrary code execution.