Multiple buffer overflow vulnerabilities have been identified in the internet.cgi set_qos() functionality of the Wavlink AC3000 M33A8.V5030.210505 router firmware. These vulnerabilities arise from improper handling of the en_enable POST parameter, allowing an authenticated attacker to trigger stack-based buffer overflows via specially crafted HTTP requests. The vulnerabilities have a critical severity rating with a CVSS score of 9.1, indicating high impact on confidentiality, integrity, and availability.