Multiple buffer overflow vulnerabilities have been identified in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. These vulnerabilities can be triggered by an authenticated attacker sending a specially crafted HTTP request, specifically exploiting the sel_mode POST parameter. The flaws can lead to stack-based buffer overflows with potential for complete compromise of confidentiality, integrity, and availability.