Multiple command injection vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. An authenticated attacker can send a specially crafted HTTP request with a malicious adddir_name POST parameter to achieve arbitrary command execution. The vulnerabilities have a high severity with a CVSS score of 9.1.