CVE-2026-9033 - Vulnerability Details

- Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways

Description

An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access.

Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.

Published: 2026-08-20

Score: 6 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

TP-Link Systems Inc.

ER7212PC v2

unaffected

Version	Status	Constraints
`0`	affected	< 2.4.3 Build 20260722 Rel.40250

TP-Link Systems Inc.

ER605 v2

unaffected

Version	Status	Constraints
`0`	affected	< 2.4.4 Build 20260630 Rel.14398

TP-Link Systems Inc.

ER7206 v2

unaffected

Version	Status	Constraints
`0`	affected	< 2.3.5 Build 20260625 Rel.43136

TP-Link Systems Inc

ER7406 v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.3.4 Build 20260625 Rel.43136

TP-Link Systems Inc.

ER707-M2 v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.4 Build 20260625 Rel.43063

TP-Link Systems Inc

ER7412-M2 v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.2.0 Build 20260630 Rel.82947

TP-Link Systems Inc.

ER8411 v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.1 Build 20260708 Rel.64832

TP-Link Systems Inc.

ER706W v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.2.11 Build 20260723 Rel.41567

TP-Link Systems Inc.

ER706W-4G v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.2.6 Build 20260723 Rel.41321

TP-Link Systems Inc.

ER706W-4G v2

unaffected

Version	Status	Constraints
`0`	affected	< 2.1.11 Build 20260723 Rel.41624

TP-Link Systems Inc.

ER706WP-4G v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.1.11 Build 20260723 Rel.41624

TP-Link Systems Inc.

ER703WP-4G-Outdoor v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.1.7 Build 20260723 Rel.41712

TP-Link Systems Inc.

DR3220v-4G v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.2.0 Build 20260630 Rel.82652

TP-Link Systems Inc.

DR3650v v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.2.0 Build 20260630 Rel.83311

TP-Link Systems Inc.

DR3650v-4G v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.2.0 Build 20260630 Rel.83347

TP-Link Systems Inc.

ER603WP-4G-Outdoor v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.0.2 Build 20260723 Rel.43271

TP-Link Systems Inc.

DR3150 v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.0.1 Build 20260722 Rel.16854

TP-Link Systems Inc.

ER701-5G-Outdoor v1

unaffected

Version	Status	Constraints
`0`	affected	< 1.0.3 Build 20260723 Rel.40931

TP-Link Systems Inc.

ER605W v2

unaffected

Version	Status	Constraints
`0`	affected	< 2.0.4 Build 20260723 Rel.43763

No data.

Vendor Product Confidence Versions

Tp-link

Dr3150 V1

100%

Version	Status	Scheme	Platform
`[0,1.0.1 Build 20260722 Rel.16854)`	affected	generic	—

Tp-link

Dr3220v-4g V1

100%

Version	Status	Scheme	Platform
`[0,1.2.0 Build 20260630 Rel.82652)`	affected	generic	—

Tp-link

Dr3650v-4g V1

100%

Version	Status	Scheme	Platform
`[0,1.2.0 Build 20260630 Rel.83347)`	affected	generic	—

Tp-link

Dr3650v V1

100%

Version	Status	Scheme	Platform
`[0,1.2.0 Build 20260630 Rel.83311)`	affected	generic	—

Tp-link

Er603wp-4g-outdoor V1

100%

Version	Status	Scheme	Platform
`[0,1.0.2 Build 20260723 Rel.43271)`	affected	generic	—

Tp-link

Er605 V2

100%

Version	Status	Scheme	Platform
`[0,2.4.4 Build 20260630 Rel.14398)`	affected	generic	—

Tp-link

Er605w V2

100%

Version	Status	Scheme	Platform
`[0,2.0.4 Build 20260723 Rel.43763)`	affected	generic	—

Tp-link

Er701-5g-outdoor V1

100%

Version	Status	Scheme	Platform
`[0,1.0.3 Build 20260723 Rel.40931)`	affected	generic	—

Tp-link

Er703wp-4g-outdoor V1

100%

Version	Status	Scheme	Platform
`[0,1.1.7 Build 20260723 Rel.41712)`	affected	generic	—

Tp-link

Er706w-4g V1

100%

Version	Status	Scheme	Platform
`[0,1.2.6 Build 20260723 Rel.41321)`	affected	generic	—

Tp-link

Er706w-4g V2

100%

Version	Status	Scheme	Platform
`[0,2.1.11 Build 20260723 Rel.41624)`	affected	generic	—

Tp-link

Er706w V1

100%

Version	Status	Scheme	Platform
`[0,1.2.11 Build 20260723 Rel.41567)`	affected	generic	—

Tp-link

Er706wp-4g V1

100%

Version	Status	Scheme	Platform
`[0,1.1.11 Build 20260723 Rel.41624)`	affected	generic	—

Tp-link

Er707-m2 V1

100%

Version	Status	Scheme	Platform
`[0,1.4.4 Build 20260625 Rel.43063)`	affected	generic	—

Tp-link

Er7206 V2

100%

Version	Status	Scheme	Platform
`[0,2.3.5 Build 20260625 Rel.43136)`	affected	generic	—

Tp-link

Er7212pc V2

100%

Version	Status	Scheme	Platform
`[0,2.4.3 Build 20260722 Rel.40250)`	affected	generic	—

Tp-link

Er7406 V1

100%

Version	Status	Scheme	Platform
`[0,1.3.4 Build 20260625 Rel.43136)`	affected	generic	—

Tp-link

Er7412-m2 V1

100%

Version	Status	Scheme	Platform
`[0,1.2.0 Build 20260630 Rel.82947)`	affected	generic	—

Tp-link

Er8411 V1

100%

Version	Status	Scheme	Platform
`[0,1.4.1 Build 20260708 Rel.64832)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00185.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.omadanetworks.com/en/support/download/
https://www.omadanetworks.com/us/support/download/
https://www.tp-link.com/us/support/faq/5256/

History

Fri, 21 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Tp-link Tp-link dr3150 V1 Tp-link dr3220v-4g V1 Tp-link dr3650v-4g V1 Tp-link dr3650v V1 Tp-link er603wp-4g-outdoor V1 Tp-link er605 V2 Tp-link er605w V2 Tp-link er701-5g-outdoor V1 Tp-link er703wp-4g-outdoor V1 Tp-link er706w-4g V1 Tp-link er706w-4g V2 Tp-link er706w V1 Tp-link er706wp-4g V1 Tp-link er707-m2 V1 Tp-link er7206 V2 Tp-link er7212pc V2 Tp-link er7406 V1 Tp-link er7412-m2 V1 Tp-link er8411 V1
Vendors & Products		Tp-link Tp-link dr3150 V1 Tp-link dr3220v-4g V1 Tp-link dr3650v-4g V1 Tp-link dr3650v V1 Tp-link er603wp-4g-outdoor V1 Tp-link er605 V2 Tp-link er605w V2 Tp-link er701-5g-outdoor V1 Tp-link er703wp-4g-outdoor V1 Tp-link er706w-4g V1 Tp-link er706w-4g V2 Tp-link er706w V1 Tp-link er706wp-4g V1 Tp-link er707-m2 V1 Tp-link er7206 V2 Tp-link er7212pc V2 Tp-link er7406 V1 Tp-link er7412-m2 V1 Tp-link er8411 V1

Thu, 20 Aug 2026 19:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 20 Aug 2026 19:00:00 +0000

Type	Values Removed	Values Added
Description		An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access. Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.
Title		Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways
Weaknesses		CWE-306
References		https://www.omadanetworks.com/en/support/download/ https://www.omadanetworks.com/us/support/download/ https://www.tp-link.com/us/support/faq/5256/
Metrics		cvssV4_0 `{'score': 6, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`

Subscriptions

Tp-link Dr3150 V1 Dr3220v-4g V1 Dr3650v-4g V1 Dr3650v V1 Er603wp-4g-outdoor V1 Er605 V2 Er605w V2 Er701-5g-outdoor V1 Er703wp-4g-outdoor V1 Er706w-4g V1 Er706w-4g V2 Er706w V1 Er706wp-4g V1 Er707-m2 V1 Er7206 V2 Er7212pc V2 Er7406 V1 Er7412-m2 V1 Er8411 V1

MITRE

Status: PUBLISHED

Assigner: TPLink

Published: 2026-08-20T18:31:54.806Z

Updated: 2026-08-20T18:59:36.657Z

Reserved: 2026-05-19T16:30:37.346Z

Link: CVE-2026-9033

Vulnrichment

Updated: 2026-08-20T18:59:33.402Z

NVD

Status : Received

Published: 2026-08-20T19:17:04.950

Modified: 2026-08-20T19:17:04.950

Link: CVE-2026-9033

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-21T12:08:39Z

Weaknesses

CWE-306

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object