Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router version 2.10.5. These vulnerabilities allow an authenticated attacker to execute arbitrary OS commands by sending a specially crafted HTTP request, exploiting the attacker-controlled 'timer1' parameter.