Wavlink AC3000 M33A8.V5030.210505 contains multiple command execution vulnerabilities in the nas.cgi add_dir() functionality. Authenticated attackers can exploit a command injection flaw in the disk_part POST parameter via specially crafted HTTP requests, leading to arbitrary command execution.