CVE-2026-9033 - Vulnerability Details

- Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways

Description

An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access.

Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.

Published: 2026-08-20

Score: 6 Medium

EPSS: < 1% Very Low

KEV: No

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

TP-Link Systems Inc.

ER7212PC v2

unaffected

Version	Status	Constraints
`0`	affected	< 2.4.3 Build 20260722 Rel.40250

TP-Link Systems Inc.

ER605 v2

unaffected

Version	Status	Constraints
`0`	affected	< 2.4.4 Build 20260630 Rel.14398

TP-Link Systems Inc.

ER7206 v2

unaffected

Version	Status	Constraints
`0`	affected	< 2.3.5 Build 20260625 Rel.43136

TP-Link Systems Inc

ER7406 v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.3.4 Build 20260625 Rel.43136

TP-Link Systems Inc.

ER707-M2 v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.4 Build 20260625 Rel.43063

TP-Link Systems Inc

ER7412-M2 v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.2.0 Build 20260630 Rel.82947

TP-Link Systems Inc.

ER8411 v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.1 Build 20260708 Rel.64832

TP-Link Systems Inc.

ER706W v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.2.11 Build 20260723 Rel.41567

TP-Link Systems Inc.

ER706W-4G v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.2.6 Build 20260723 Rel.41321

TP-Link Systems Inc.

ER706W-4G v2

unaffected

Version	Status	Constraints
`0`	affected	< 2.1.11 Build 20260723 Rel.41624

TP-Link Systems Inc.

ER706WP-4G v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.1.11 Build 20260723 Rel.41624

TP-Link Systems Inc.

ER703WP-4G-Outdoor v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.1.7 Build 20260723 Rel.41712

TP-Link Systems Inc.

DR3220v-4G v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.2.0 Build 20260630 Rel.82652

TP-Link Systems Inc.

DR3650v v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.2.0 Build 20260630 Rel.83311

TP-Link Systems Inc.

DR3650v-4G v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.2.0 Build 20260630 Rel.83347

TP-Link Systems Inc.

ER603WP-4G-Outdoor v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.0.2 Build 20260723 Rel.43271

TP-Link Systems Inc.

DR3150 v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.0.1 Build 20260722 Rel.16854

TP-Link Systems Inc.

ER701-5G-Outdoor v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.0.3 Build 20260723 Rel.40931

TP-Link Systems Inc.

ER605W v2

unaffected

Version	Status	Constraints
`0`	affected	< 2.0.4 Build 20260723 Rel.43763

Configuration 1 [-]

AND

cpe:2.3:o:tp-link:er7212pc_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er7212pc:2.0:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:tp-link:er605_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er605:2.0:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:tp-link:er7206_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er7206:2.0:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:tp-link:er7406_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er7406:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:tp-link:er707-m2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er707-m2:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:tp-link:er7412-m2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er7412-m2:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

cpe:2.3:o:tp-link:er8411_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er8411:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND

cpe:2.3:o:tp-link:er706w_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er706w:-:*:*:*:*:*:*:*

Configuration 9 [-]

AND

cpe:2.3:o:tp-link:er706w-4g_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er706w-4g:-:*:*:*:*:*:*:*

Configuration 10 [-]

AND

cpe:2.3:o:tp-link:er706w-4g_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er706w-4g:2.0:*:*:*:*:*:*:*

Configuration 11 [-]

AND

cpe:2.3:o:tp-link:er706wp-4g_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er706wp-4g:-:*:*:*:*:*:*:*

Configuration 12 [-]

AND

cpe:2.3:o:tp-link:er703wp-4g-outdoor_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er703wp-4g-outdoor:-:*:*:*:*:*:*:*

Configuration 13 [-]

AND

cpe:2.3:o:tp-link:dr3220v-4g_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:dr3220v-4g:-:*:*:*:*:*:*:*

Configuration 14 [-]

AND

cpe:2.3:o:tp-link:dr3650v_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:dr3650v:-:*:*:*:*:*:*:*

Configuration 15 [-]

AND

cpe:2.3:o:tp-link:dr3650v-4g_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:dr3650v-4g:-:*:*:*:*:*:*:*

Configuration 16 [-]

AND

cpe:2.3:o:tp-link:er603wp-4g-outdoor_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er603wp-4g-outdoor:-:*:*:*:*:*:*:*

Configuration 17 [-]

AND

cpe:2.3:o:tp-link:dr3150_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:dr3150:-:*:*:*:*:*:*:*

Configuration 18 [-]

AND

cpe:2.3:o:tp-link:er701-5g-outdoor_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er701-5g-outdoor:-:*:*:*:*:*:*:*

Configuration 19 [-]

AND

cpe:2.3:o:tp-link:er605w_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:er605w:2.0:*:*:*:*:*:*:*

No data.

Vendor Product Confidence Versions

Tp-link

Dr3150 V1

100%

Version	Status	Scheme	Platform
`[0,1.0.1 Build 20260722 Rel.16854)`	affected	generic	—

Tp-link

Dr3220v-4g V1

100%

Version	Status	Scheme	Platform
`[0,1.2.0 Build 20260630 Rel.82652)`	affected	generic	—

Tp-link

Dr3650v-4g V1

100%

Version	Status	Scheme	Platform
`[0,1.2.0 Build 20260630 Rel.83347)`	affected	generic	—

Tp-link

Dr3650v V1

100%

Version	Status	Scheme	Platform
`[0,1.2.0 Build 20260630 Rel.83311)`	affected	generic	—

Tp-link

Er603wp-4g-outdoor V1

100%

Version	Status	Scheme	Platform
`[0,1.0.2 Build 20260723 Rel.43271)`	affected	generic	—

Tp-link

Er605 V2

100%

Version	Status	Scheme	Platform
`[0,2.4.4 Build 20260630 Rel.14398)`	affected	generic	—

Tp-link

Er605w V2

100%

Version	Status	Scheme	Platform
`[0,2.0.4 Build 20260723 Rel.43763)`	affected	generic	—

Tp-link

Er701-5g-outdoor V1

100%

Version	Status	Scheme	Platform
`[0,1.0.3 Build 20260723 Rel.40931)`	affected	generic	—

Tp-link

Er703wp-4g-outdoor V1

100%

Version	Status	Scheme	Platform
`[0,1.1.7 Build 20260723 Rel.41712)`	affected	generic	—

Tp-link

Er706w-4g V1

100%

Version	Status	Scheme	Platform
`[0,1.2.6 Build 20260723 Rel.41321)`	affected	generic	—

Tp-link

Er706w-4g V2

100%

Version	Status	Scheme	Platform
`[0,2.1.11 Build 20260723 Rel.41624)`	affected	generic	—

Tp-link

Er706w V1

100%

Version	Status	Scheme	Platform
`[0,1.2.11 Build 20260723 Rel.41567)`	affected	generic	—

Tp-link

Er706wp-4g V1

100%

Version	Status	Scheme	Platform
`[0,1.1.11 Build 20260723 Rel.41624)`	affected	generic	—

Tp-link

Er707-m2 V1

100%

Version	Status	Scheme	Platform
`[0,1.4.4 Build 20260625 Rel.43063)`	affected	generic	—

Tp-link

Er7206 V2

100%

Version	Status	Scheme	Platform
`[0,2.3.5 Build 20260625 Rel.43136)`	affected	generic	—

Tp-link

Er7212pc V2

100%

Version	Status	Scheme	Platform
`[0,2.4.3 Build 20260722 Rel.40250)`	affected	generic	—

Tp-link

Er7406 V1

100%

Version	Status	Scheme	Platform
`[0,1.3.4 Build 20260625 Rel.43136)`	affected	generic	—

Tp-link

Er7412-m2 V1

100%

Version	Status	Scheme	Platform
`[0,1.2.0 Build 20260630 Rel.82947)`	affected	generic	—

Tp-link

Er8411 V1

100%

Version	Status	Scheme	Platform
`[0,1.4.1 Build 20260708 Rel.64832)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00196.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.omadanetworks.com/en/support/download/
https://www.omadanetworks.com/us/support/download/
https://www.tp-link.com/us/support/faq/5256/

History

Tue, 08 Sep 2026 21:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Tp-link dr3150 Tp-link dr3150 Firmware Tp-link dr3220v-4g Tp-link dr3220v-4g Firmware Tp-link dr3650v Tp-link dr3650v-4g Tp-link dr3650v-4g Firmware Tp-link dr3650v Firmware Tp-link er603wp-4g-outdoor Tp-link er603wp-4g-outdoor Firmware Tp-link er605 Tp-link er605 Firmware Tp-link er605w Tp-link er605w Firmware Tp-link er701-5g-outdoor Tp-link er701-5g-outdoor Firmware Tp-link er703wp-4g-outdoor Tp-link er703wp-4g-outdoor Firmware Tp-link er706w Tp-link er706w-4g Tp-link er706w-4g Firmware Tp-link er706w Firmware Tp-link er706wp-4g Tp-link er706wp-4g Firmware Tp-link er707-m2 Tp-link er707-m2 Firmware Tp-link er7206 Tp-link er7206 Firmware Tp-link er7212pc Tp-link er7212pc Firmware Tp-link er7406 Tp-link er7406 Firmware Tp-link er7412-m2 Tp-link er7412-m2 Firmware Tp-link er8411 Tp-link er8411 Firmware
CPEs		cpe:2.3:h:tp-link:dr3150:-:::::::* cpe:2.3:h:tp-link:dr3220v-4g:-:::::::* cpe:2.3:h:tp-link:dr3650v-4g:-:::::::* cpe:2.3:h:tp-link:dr3650v:-:::::::* cpe:2.3:h:tp-link:er603wp-4g-outdoor:-:::::::* cpe:2.3:h:tp-link:er605:2.0:::::::* cpe:2.3:h:tp-link:er605w:2.0:::::::* cpe:2.3:h:tp-link:er701-5g-outdoor:-:::::::* cpe:2.3:h:tp-link:er703wp-4g-outdoor:-:::::::* cpe:2.3:h:tp-link:er706w-4g:-:::::::* cpe:2.3:h:tp-link:er706w-4g:2.0:::::::* cpe:2.3:h:tp-link:er706w:-:::::::* cpe:2.3:h:tp-link:er706wp-4g:-:::::::* cpe:2.3:h:tp-link:er707-m2:-:::::::* cpe:2.3:h:tp-link:er7206:2.0:::::::* cpe:2.3:h:tp-link:er7212pc:2.0:::::::* cpe:2.3:h:tp-link:er7406:-:::::::* cpe:2.3:h:tp-link:er7412-m2:-:::::::* cpe:2.3:h:tp-link:er8411:-:::::::* cpe:2.3:o:tp-link:dr3150_firmware:::::::: cpe:2.3:o:tp-link:dr3220v-4g_firmware:::::::: cpe:2.3:o:tp-link:dr3650v-4g_firmware:::::::: cpe:2.3:o:tp-link:dr3650v_firmware:::::::: cpe:2.3:o:tp-link:er603wp-4g-outdoor_firmware:::::::: cpe:2.3:o:tp-link:er605_firmware:::::::: cpe:2.3:o:tp-link:er605w_firmware:::::::: cpe:2.3:o:tp-link:er701-5g-outdoor_firmware:::::::: cpe:2.3:o:tp-link:er703wp-4g-outdoor_firmware:::::::: cpe:2.3:o:tp-link:er706w-4g_firmware:::::::: cpe:2.3:o:tp-link:er706w_firmware:::::::: cpe:2.3:o:tp-link:er706wp-4g_firmware:::::::: cpe:2.3:o:tp-link:er707-m2_firmware:::::::: cpe:2.3:o:tp-link:er7206_firmware:::::::: cpe:2.3:o:tp-link:er7212pc_firmware:::::::: cpe:2.3:o:tp-link:er7406_firmware:::::::: cpe:2.3:o:tp-link:er7412-m2_firmware:::::::: cpe:2.3:o:tp-link:er8411_firmware::::::::
Vendors & Products		Tp-link dr3150 Tp-link dr3150 Firmware Tp-link dr3220v-4g Tp-link dr3220v-4g Firmware Tp-link dr3650v Tp-link dr3650v-4g Tp-link dr3650v-4g Firmware Tp-link dr3650v Firmware Tp-link er603wp-4g-outdoor Tp-link er603wp-4g-outdoor Firmware Tp-link er605 Tp-link er605 Firmware Tp-link er605w Tp-link er605w Firmware Tp-link er701-5g-outdoor Tp-link er701-5g-outdoor Firmware Tp-link er703wp-4g-outdoor Tp-link er703wp-4g-outdoor Firmware Tp-link er706w Tp-link er706w-4g Tp-link er706w-4g Firmware Tp-link er706w Firmware Tp-link er706wp-4g Tp-link er706wp-4g Firmware Tp-link er707-m2 Tp-link er707-m2 Firmware Tp-link er7206 Tp-link er7206 Firmware Tp-link er7212pc Tp-link er7212pc Firmware Tp-link er7406 Tp-link er7406 Firmware Tp-link er7412-m2 Tp-link er7412-m2 Firmware Tp-link er8411 Tp-link er8411 Firmware
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}`

Fri, 21 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Tp-link Tp-link dr3150 V1 Tp-link dr3220v-4g V1 Tp-link dr3650v-4g V1 Tp-link dr3650v V1 Tp-link er603wp-4g-outdoor V1 Tp-link er605 V2 Tp-link er605w V2 Tp-link er701-5g-outdoor V1 Tp-link er703wp-4g-outdoor V1 Tp-link er706w-4g V1 Tp-link er706w-4g V2 Tp-link er706w V1 Tp-link er706wp-4g V1 Tp-link er707-m2 V1 Tp-link er7206 V2 Tp-link er7212pc V2 Tp-link er7406 V1 Tp-link er7412-m2 V1 Tp-link er8411 V1
Vendors & Products		Tp-link Tp-link dr3150 V1 Tp-link dr3220v-4g V1 Tp-link dr3650v-4g V1 Tp-link dr3650v V1 Tp-link er603wp-4g-outdoor V1 Tp-link er605 V2 Tp-link er605w V2 Tp-link er701-5g-outdoor V1 Tp-link er703wp-4g-outdoor V1 Tp-link er706w-4g V1 Tp-link er706w-4g V2 Tp-link er706w V1 Tp-link er706wp-4g V1 Tp-link er707-m2 V1 Tp-link er7206 V2 Tp-link er7212pc V2 Tp-link er7406 V1 Tp-link er7412-m2 V1 Tp-link er8411 V1

Thu, 20 Aug 2026 19:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 20 Aug 2026 19:00:00 +0000

Type	Values Removed	Values Added
Description		An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access. Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.
Title		Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways
Weaknesses		CWE-306
References		https://www.omadanetworks.com/en/support/download/ https://www.omadanetworks.com/us/support/download/ https://www.tp-link.com/us/support/faq/5256/
Metrics		cvssV4_0 `{'score': 6, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`

Subscriptions

Tp-link Dr3150 Dr3150 Firmware Dr3150 V1 Dr3220v-4g Dr3220v-4g Firmware Dr3220v-4g V1 Dr3650v Dr3650v-4g Dr3650v-4g Firmware Dr3650v-4g V1 Dr3650v Firmware Dr3650v V1 Er603wp-4g-outdoor Er603wp-4g-outdoor Firmware Er603wp-4g-outdoor V1 Er605 Er605 Firmware Er605 V2 Er605w Er605w Firmware Er605w V2 Er701-5g-outdoor Er701-5g-outdoor Firmware Er701-5g-outdoor V1 Er703wp-4g-outdoor Er703wp-4g-outdoor Firmware Er703wp-4g-outdoor V1 Er706w Er706w-4g Er706w-4g Firmware Er706w-4g V1 Er706w-4g V2 Er706w Firmware Er706w V1 Er706wp-4g Er706wp-4g Firmware Er706wp-4g V1 Er707-m2 Er707-m2 Firmware Er707-m2 V1 Er7206 Er7206 Firmware Er7206 V2 Er7212pc Er7212pc Firmware Er7212pc V2 Er7406 Er7406 Firmware Er7406 V1 Er7412-m2 Er7412-m2 Firmware Er7412-m2 V1 Er8411 Er8411 Firmware Er8411 V1

MITRE

Status: PUBLISHED

Assigner: TPLink

Published: 2026-08-20T18:31:54.806Z

Updated: 2026-08-20T18:59:36.657Z

Reserved: 2026-05-19T16:30:37.346Z

Link: CVE-2026-9033

Vulnrichment

Updated: 2026-08-20T18:59:33.402Z

NVD

Status : Analyzed

Published: 2026-08-20T19:17:04.950

Modified: 2026-09-08T20:41:37.217

Link: CVE-2026-9033

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-21T12:08:39Z

Weaknesses

CWE-306

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object