Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. These vulnerabilities allow unauthenticated attackers to execute arbitrary code via specially crafted HTTP requests, specifically through the restart_week_value POST parameter. The vulnerabilities have a critical severity with a CVSS score of 10. No patch or remediation information is currently provided.