Multiple buffer overflow vulnerabilities have been identified in the internet.cgi set_qos() functionality of the Wavlink AC3000 M33A8.V5030.210505 router firmware. These vulnerabilities arise from improper handling of the cli_name POST parameter, allowing an authenticated attacker to trigger a stack-based buffer overflow via a specially crafted HTTP request. The vulnerabilities have a high severity with a CVSS score of 9.1, indicating critical impact on confidentiality, integrity, and availability.