Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. These vulnerabilities allow unauthenticated attackers to execute arbitrary code via specially crafted HTTP requests, specifically through the restart_hour_value POST parameter. The flaw has a critical CVSS score of 10.0, indicating high impact on confidentiality, integrity, and availability.