Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. These vulnerabilities can be triggered by an authenticated attacker sending a specially crafted HTTP request, specifically exploiting the qos_bandwidth POST parameter. The flaw leads to a stack-based buffer overflow with potential for complete compromise.