Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. These vulnerabilities can be triggered by an authenticated attacker sending a specially crafted HTTP request, specifically exploiting the custom_interface POST parameter to execute arbitrary commands on the device.