Multiple external configuration control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. These vulnerabilities allow an attacker with authenticated HTTP access to bypass permissions and inject malicious configuration via the ftp_max_sessions POST parameter. The issue is classified as critical with a CVSS score of 9.1.