CVE-2026-9033 PUBLISHED

Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways

Assigner: TPLink
Reserved: 19.05.2026 Published: 20.08.2026 Updated: 20.08.2026

An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access. 

Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.

Metrics

CVSS Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS Score: 6

Product Status

Vendor TP-Link Systems Inc.
Product ER7212PC v2
Versions Default: unaffected
  • affected from 0 to 2.4.3 Build 20260722 Rel.40250 (excl.)
Vendor TP-Link Systems Inc.
Product ER605 v2
Versions Default: unaffected
  • affected from 0 to 2.4.4 Build 20260630 Rel.14398 (excl.)
Vendor TP-Link Systems Inc.
Product ER7206 v2
Versions Default: unaffected
  • affected from 0 to 2.3.5 Build 20260625 Rel.43136 (excl.)
Vendor TP-Link Systems Inc
Product ER7406 v1
Versions Default: unaffected
  • affected from 0 to 1.3.4 Build 20260625 Rel.43136 (excl.)
Vendor TP-Link Systems Inc.
Product ER707-M2 v1
Versions Default: unaffected
  • affected from 0 to 1.4.4 Build 20260625 Rel.43063 (excl.)
Vendor TP-Link Systems Inc
Product ER7412-M2 v1
Versions Default: unaffected
  • affected from 0 to 1.2.0 Build 20260630 Rel.82947 (excl.)
Vendor TP-Link Systems Inc.
Product ER8411 v1
Versions Default: unaffected
  • affected from 0 to 1.4.1 Build 20260708 Rel.64832 (excl.)
Vendor TP-Link Systems Inc.
Product ER706W v1
Versions Default: unaffected
  • affected from 0 to 1.2.11 Build 20260723 Rel.41567 (excl.)
Vendor TP-Link Systems Inc.
Product ER706W-4G v1
Versions Default: unaffected
  • affected from 0 to 1.2.6 Build 20260723 Rel.41321 (excl.)
Vendor TP-Link Systems Inc.
Product ER706W-4G v2
Versions Default: unaffected
  • affected from 0 to 2.1.11 Build 20260723 Rel.41624 (excl.)
Vendor TP-Link Systems Inc.
Product ER706WP-4G v1
Versions Default: unaffected
  • affected from 0 to 1.1.11 Build 20260723 Rel.41624 (excl.)
Vendor TP-Link Systems Inc.
Product ER703WP-4G-Outdoor v1
Versions Default: unaffected
  • affected from 0 to 1.1.7 Build 20260723 Rel.41712 (excl.)
Vendor TP-Link Systems Inc.
Product DR3220v-4G v1
Versions Default: unaffected
  • affected from 0 to 1.2.0 Build 20260630 Rel.82652 (excl.)
Vendor TP-Link Systems Inc.
Product DR3650v v1
Versions Default: unaffected
  • affected from 0 to 1.2.0 Build 20260630 Rel.83311 (excl.)
Vendor TP-Link Systems Inc.
Product DR3650v-4G v1
Versions Default: unaffected
  • affected from 0 to 1.2.0 Build 20260630 Rel.83347 (excl.)
Vendor TP-Link Systems Inc.
Product ER603WP-4G-Outdoor v1
Versions Default: unaffected
  • affected from 0 to 1.0.2 Build 20260723 Rel.43271 (excl.)
Vendor TP-Link Systems Inc.
Product DR3150 v1
Versions Default: unaffected
  • affected from 0 to 1.0.1 Build 20260722 Rel.16854 (excl.)
Vendor TP-Link Systems Inc.
Product ER701-5G-Outdoor v1
Versions Default: unaffected
  • affected from 0 to 1.0.3 Build 20260723 Rel.40931 (excl.)
Vendor TP-Link Systems Inc.
Product ER605W v2
Versions Default: unaffected
  • affected from 0 to 2.0.4 Build 20260723 Rel.43763 (excl.)

Credits

  • Yoontae Lee (@yunttai) finder

References

Problem Types

  • CWE-306 Missing Authentication for Critical Function CWE

Impacts

  • CAPEC-115 Authentication Bypass