CVE-2026-9033

Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways

Published Aug 20, 2026 CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Description

An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access.

Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.

Analysis

Technical impact

An attacker with access to a device’s captive portal service, without needing credentials, can terminate any active sessions. This allows the attacker to force users to log in again or clear all present sessions, disrupting normal access without compromising the device itself. The flaw is a missing authentication check for session control functions (CWE‑306).

Affected Systems

TP‑Link Systems Inc. devices including the DR3150 v1, DR3220v‑4G v1, DR3650v v1, DR3650v‑4G v1, ER603WP‑4G‑Outdoor v1, ER605 v2, ER605W v2, ER701‑5G‑Outdoor v1, ER703WP‑4G‑Outdoor v1, ER706W v1, ER706W‑4G v1, ER706W‑4G v2, ER706WP‑4G v1, ER707‑M2 v1, ER7206 v2, ER7212PC v2, ER8411 v1, ER7406 v1, and ER7412‑M2 v1.

Risk and Exploitability

The vulnerability has a CVSS score of 6, indicating medium severity. EPSS data is unavailable and the issue is not listed in the CISA KEV catalog, implying no known wide‑scale exploitation yet. An attacker who can reach the portal service—likely a local or intruder network—can directly exploit the flaw to terminate sessions without authentication, causing temporary disruption and forced re‑authentication for affected users.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

TP-Link Systems Inc.

ER7212PC v2

unaffected

Version	Status	Constraints
`0`	affected	< 2.4.3 Build 20260722 Rel.40250

TP-Link Systems Inc.

ER605 v2

unaffected

Version	Status	Constraints
`0`	affected	< 2.4.4 Build 20260630 Rel.14398

TP-Link Systems Inc.

ER7206 v2

unaffected

Version	Status	Constraints
`0`	affected	< 2.3.5 Build 20260625 Rel.43136

TP-Link Systems Inc

ER7406 v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.3.4 Build 20260625 Rel.43136

TP-Link Systems Inc.

ER707-M2 v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.4 Build 20260625 Rel.43063

TP-Link Systems Inc

ER7412-M2 v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.2.0 Build 20260630 Rel.82947

TP-Link Systems Inc.

ER8411 v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.1 Build 20260708 Rel.64832

TP-Link Systems Inc.

ER706W v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.2.11 Build 20260723 Rel.41567

TP-Link Systems Inc.

ER706W-4G v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.2.6 Build 20260723 Rel.41321

TP-Link Systems Inc.

ER706W-4G v2

unaffected

Version	Status	Constraints
`0`	affected	< 2.1.11 Build 20260723 Rel.41624

TP-Link Systems Inc.

ER706WP-4G v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.1.11 Build 20260723 Rel.41624

TP-Link Systems Inc.

ER703WP-4G-Outdoor v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.1.7 Build 20260723 Rel.41712

TP-Link Systems Inc.

DR3220v-4G v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.2.0 Build 20260630 Rel.82652

TP-Link Systems Inc.

DR3650v v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.2.0 Build 20260630 Rel.83311

TP-Link Systems Inc.

DR3650v-4G v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.2.0 Build 20260630 Rel.83347

TP-Link Systems Inc.

ER603WP-4G-Outdoor v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.0.2 Build 20260723 Rel.43271

TP-Link Systems Inc.

DR3150 v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.0.1 Build 20260722 Rel.16854

TP-Link Systems Inc.

ER701-5G-Outdoor v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.0.3 Build 20260723 Rel.40931

TP-Link Systems Inc.

ER605W v2

unaffected

Version	Status	Constraints
`0`	affected	< 2.0.4 Build 20260723 Rel.43763

Configuration 1 [-]

AND

cpe:2.3:o:tp-link:er7212pc_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er7212pc:2.0:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:tp-link:er605_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er605:2.0:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:tp-link:er7206_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er7206:2.0:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:tp-link:er7406_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er7406:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:tp-link:er707-m2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er707-m2:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:tp-link:er7412-m2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er7412-m2:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

cpe:2.3:o:tp-link:er8411_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er8411:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND

cpe:2.3:o:tp-link:er706w_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er706w:-:*:*:*:*:*:*:*

Configuration 9 [-]

AND

cpe:2.3:o:tp-link:er706w-4g_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er706w-4g:-:*:*:*:*:*:*:*

Configuration 10 [-]

AND

cpe:2.3:o:tp-link:er706w-4g_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er706w-4g:2.0:*:*:*:*:*:*:*

Configuration 11 [-]

AND

cpe:2.3:o:tp-link:er706wp-4g_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er706wp-4g:-:*:*:*:*:*:*:*

Configuration 12 [-]

AND

cpe:2.3:o:tp-link:er703wp-4g-outdoor_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er703wp-4g-outdoor:-:*:*:*:*:*:*:*

Configuration 13 [-]

AND

cpe:2.3:o:tp-link:dr3220v-4g_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:dr3220v-4g:-:*:*:*:*:*:*:*

Configuration 14 [-]

AND

cpe:2.3:o:tp-link:dr3650v_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:dr3650v:-:*:*:*:*:*:*:*

Configuration 15 [-]

AND

cpe:2.3:o:tp-link:dr3650v-4g_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:dr3650v-4g:-:*:*:*:*:*:*:*

Configuration 16 [-]

AND

cpe:2.3:o:tp-link:er603wp-4g-outdoor_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er603wp-4g-outdoor:-:*:*:*:*:*:*:*

Configuration 17 [-]

AND

cpe:2.3:o:tp-link:dr3150_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:dr3150:-:*:*:*:*:*:*:*

Configuration 18 [-]

AND

cpe:2.3:o:tp-link:er701-5g-outdoor_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er701-5g-outdoor:-:*:*:*:*:*:*:*

Configuration 19 [-]

AND

cpe:2.3:o:tp-link:er605w_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er605w:2.0:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Tp-link

Dr3150 V1

Version	Status	Scheme	Platform
`[0,1.0.1 Build 20260722 Rel.16854)`	affected	generic	—

Tp-link

Dr3220v-4g V1

Version	Status	Scheme	Platform
`[0,1.2.0 Build 20260630 Rel.82652)`	affected	generic	—

Tp-link

Dr3650v-4g V1

Version	Status	Scheme	Platform
`[0,1.2.0 Build 20260630 Rel.83347)`	affected	generic	—

Tp-link

Dr3650v V1

Version	Status	Scheme	Platform
`[0,1.2.0 Build 20260630 Rel.83311)`	affected	generic	—

Tp-link

Er603wp-4g-outdoor V1

Version	Status	Scheme	Platform
`[0,1.0.2 Build 20260723 Rel.43271)`	affected	generic	—

Tp-link

Er605 V2

Version	Status	Scheme	Platform
`[0,2.4.4 Build 20260630 Rel.14398)`	affected	generic	—

Tp-link

Er605w V2

Version	Status	Scheme	Platform
`[0,2.0.4 Build 20260723 Rel.43763)`	affected	generic	—

Tp-link

Er701-5g-outdoor V1

Version	Status	Scheme	Platform
`[0,1.0.3 Build 20260723 Rel.40931)`	affected	generic	—

Tp-link

Er703wp-4g-outdoor V1

Version	Status	Scheme	Platform
`[0,1.1.7 Build 20260723 Rel.41712)`	affected	generic	—

Tp-link

Er706w-4g V1

Version	Status	Scheme	Platform
`[0,1.2.6 Build 20260723 Rel.41321)`	affected	generic	—

Tp-link

Er706w-4g V2

Version	Status	Scheme	Platform
`[0,2.1.11 Build 20260723 Rel.41624)`	affected	generic	—

Tp-link

Er706w V1

Version	Status	Scheme	Platform
`[0,1.2.11 Build 20260723 Rel.41567)`	affected	generic	—

Tp-link

Er706wp-4g V1

Version	Status	Scheme	Platform
`[0,1.1.11 Build 20260723 Rel.41624)`	affected	generic	—

Tp-link

Er707-m2 V1

Version	Status	Scheme	Platform
`[0,1.4.4 Build 20260625 Rel.43063)`	affected	generic	—

Tp-link

Er7206 V2

Version	Status	Scheme	Platform
`[0,2.3.5 Build 20260625 Rel.43136)`	affected	generic	—

Tp-link

Er7212pc V2

Version	Status	Scheme	Platform
`[0,2.4.3 Build 20260722 Rel.40250)`	affected	generic	—

Tp-link

Er7406 V1

Version	Status	Scheme	Platform
`[0,1.3.4 Build 20260625 Rel.43136)`	affected	generic	—

Tp-link

Er7412-m2 V1

Version	Status	Scheme	Platform
`[0,1.2.0 Build 20260630 Rel.82947)`	affected	generic	—

Tp-link

Er8411 V1

Version	Status	Scheme	Platform
`[0,1.4.1 Build 20260708 Rel.64832)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest firmware update from TP‑Link that addresses the captive portal session control issue.
Restrict external access to the captive portal management interface using a firewall or network segmentation so that only trusted management hosts can reach it.
Once the update is applied, monitor device logs for repeated session termination attempts and verify that the captive portal functions only after successful authentication.

Generated by OpenCVE AI on August 21, 2026 at 01:32 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.277% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.omadanetworks.com/en/support/download/
https://www.omadanetworks.com/us/support/download/
https://www.tp-link.com/us/support/faq/5256/

History

Sep 8, 2026 9:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Tp-link dr3150 Tp-link dr3150 Firmware Tp-link dr3220v-4g Tp-link dr3220v-4g Firmware Tp-link dr3650v Tp-link dr3650v-4g Tp-link dr3650v-4g Firmware Tp-link dr3650v Firmware Tp-link er603wp-4g-outdoor Tp-link er603wp-4g-outdoor Firmware Tp-link er605 Tp-link er605 Firmware Tp-link er605w Tp-link er605w Firmware Tp-link er701-5g-outdoor Tp-link er701-5g-outdoor Firmware Tp-link er703wp-4g-outdoor Tp-link er703wp-4g-outdoor Firmware Tp-link er706w Tp-link er706w-4g Tp-link er706w-4g Firmware Tp-link er706w Firmware Tp-link er706wp-4g Tp-link er706wp-4g Firmware Tp-link er707-m2 Tp-link er707-m2 Firmware Tp-link er7206 Tp-link er7206 Firmware Tp-link er7212pc Tp-link er7212pc Firmware Tp-link er7406 Tp-link er7406 Firmware Tp-link er7412-m2 Tp-link er7412-m2 Firmware Tp-link er8411 Tp-link er8411 Firmware
CPEs		cpe:2.3:h:tp-link:dr3150:-:::::::* cpe:2.3:h:tp-link:dr3220v-4g:-:::::::* cpe:2.3:h:tp-link:dr3650v-4g:-:::::::* cpe:2.3:h:tp-link:dr3650v:-:::::::* cpe:2.3:h:tp-link:er603wp-4g-outdoor:-:::::::* cpe:2.3:h:tp-link:er605:2.0:::::::* cpe:2.3:h:tp-link:er605w:2.0:::::::* cpe:2.3:h:tp-link:er701-5g-outdoor:-:::::::* cpe:2.3:h:tp-link:er703wp-4g-outdoor:-:::::::* cpe:2.3:h:tp-link:er706w-4g:-:::::::* cpe:2.3:h:tp-link:er706w-4g:2.0:::::::* cpe:2.3:h:tp-link:er706w:-:::::::* cpe:2.3:h:tp-link:er706wp-4g:-:::::::* cpe:2.3:h:tp-link:er707-m2:-:::::::* cpe:2.3:h:tp-link:er7206:2.0:::::::* cpe:2.3:h:tp-link:er7212pc:2.0:::::::* cpe:2.3:h:tp-link:er7406:-:::::::* cpe:2.3:h:tp-link:er7412-m2:-:::::::* cpe:2.3:h:tp-link:er8411:-:::::::* cpe:2.3:o:tp-link:dr3150_firmware:::::::: cpe:2.3:o:tp-link:dr3220v-4g_firmware:::::::: cpe:2.3:o:tp-link:dr3650v-4g_firmware:::::::: cpe:2.3:o:tp-link:dr3650v_firmware:::::::: cpe:2.3:o:tp-link:er603wp-4g-outdoor_firmware:::::::: cpe:2.3:o:tp-link:er605_firmware:::::::: cpe:2.3:o:tp-link:er605w_firmware:::::::: cpe:2.3:o:tp-link:er701-5g-outdoor_firmware:::::::: cpe:2.3:o:tp-link:er703wp-4g-outdoor_firmware:::::::: cpe:2.3:o:tp-link:er706w-4g_firmware:::::::: cpe:2.3:o:tp-link:er706w_firmware:::::::: cpe:2.3:o:tp-link:er706wp-4g_firmware:::::::: cpe:2.3:o:tp-link:er707-m2_firmware:::::::: cpe:2.3:o:tp-link:er7206_firmware:::::::: cpe:2.3:o:tp-link:er7212pc_firmware:::::::: cpe:2.3:o:tp-link:er7406_firmware:::::::: cpe:2.3:o:tp-link:er7412-m2_firmware:::::::: cpe:2.3:o:tp-link:er8411_firmware::::::::
Vendors & Products		Tp-link dr3150 Tp-link dr3150 Firmware Tp-link dr3220v-4g Tp-link dr3220v-4g Firmware Tp-link dr3650v Tp-link dr3650v-4g Tp-link dr3650v-4g Firmware Tp-link dr3650v Firmware Tp-link er603wp-4g-outdoor Tp-link er603wp-4g-outdoor Firmware Tp-link er605 Tp-link er605 Firmware Tp-link er605w Tp-link er605w Firmware Tp-link er701-5g-outdoor Tp-link er701-5g-outdoor Firmware Tp-link er703wp-4g-outdoor Tp-link er703wp-4g-outdoor Firmware Tp-link er706w Tp-link er706w-4g Tp-link er706w-4g Firmware Tp-link er706w Firmware Tp-link er706wp-4g Tp-link er706wp-4g Firmware Tp-link er707-m2 Tp-link er707-m2 Firmware Tp-link er7206 Tp-link er7206 Firmware Tp-link er7212pc Tp-link er7212pc Firmware Tp-link er7406 Tp-link er7406 Firmware Tp-link er7412-m2 Tp-link er7412-m2 Firmware Tp-link er8411 Tp-link er8411 Firmware
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}`

Aug 21, 2026 12:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Tp-link Tp-link dr3150 V1 Tp-link dr3220v-4g V1 Tp-link dr3650v-4g V1 Tp-link dr3650v V1 Tp-link er603wp-4g-outdoor V1 Tp-link er605 V2 Tp-link er605w V2 Tp-link er701-5g-outdoor V1 Tp-link er703wp-4g-outdoor V1 Tp-link er706w-4g V1 Tp-link er706w-4g V2 Tp-link er706w V1 Tp-link er706wp-4g V1 Tp-link er707-m2 V1 Tp-link er7206 V2 Tp-link er7212pc V2 Tp-link er7406 V1 Tp-link er7412-m2 V1 Tp-link er8411 V1
Vendors & Products		Tp-link Tp-link dr3150 V1 Tp-link dr3220v-4g V1 Tp-link dr3650v-4g V1 Tp-link dr3650v V1 Tp-link er603wp-4g-outdoor V1 Tp-link er605 V2 Tp-link er605w V2 Tp-link er701-5g-outdoor V1 Tp-link er703wp-4g-outdoor V1 Tp-link er706w-4g V1 Tp-link er706w-4g V2 Tp-link er706w V1 Tp-link er706wp-4g V1 Tp-link er707-m2 V1 Tp-link er7206 V2 Tp-link er7212pc V2 Tp-link er7406 V1 Tp-link er7412-m2 V1 Tp-link er8411 V1

Aug 20, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 20, 2026 7:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access. Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.
Title		Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways
Weaknesses		CWE-306
References		https://www.omadanetworks.com/en/support/download/ https://www.omadanetworks.com/us/support/download/ https://www.tp-link.com/us/support/faq/5256/
Metrics		cvssV4_0 `{'score': 6, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`

Subscriptions

Tp-link Dr3150 Dr3150 Firmware Dr3150 V1 Dr3220v-4g Dr3220v-4g Firmware Dr3220v-4g V1 Dr3650v Dr3650v-4g Dr3650v-4g Firmware Dr3650v-4g V1 Dr3650v Firmware Dr3650v V1 Er603wp-4g-outdoor Er603wp-4g-outdoor Firmware Er603wp-4g-outdoor V1 Er605 Er605 Firmware Er605 V2 Er605w Er605w Firmware Er605w V2 Er701-5g-outdoor Er701-5g-outdoor Firmware Er701-5g-outdoor V1 Er703wp-4g-outdoor Er703wp-4g-outdoor Firmware Er703wp-4g-outdoor V1 Er706w Er706w-4g Er706w-4g Firmware Er706w-4g V1 Er706w-4g V2 Er706w Firmware Er706w V1 Er706wp-4g Er706wp-4g Firmware Er706wp-4g V1 Er707-m2 Er707-m2 Firmware Er707-m2 V1 Er7206 Er7206 Firmware Er7206 V2 Er7212pc Er7212pc Firmware Er7212pc V2 Er7406 Er7406 Firmware Er7406 V1 Er7412-m2 Er7412-m2 Firmware Er7412-m2 V1 Er8411 Er8411 Firmware Er8411 V1

Weaknesses