Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. These vulnerabilities can be triggered by unauthenticated attackers via specially crafted HTTP requests, specifically through the restart_min_value POST parameter, potentially allowing arbitrary code execution.