4.3

CVE-2026-9033

Medienbericht

Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways

An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access. 



Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Tp-link ≫ Er7212pc Firmware Version < 2.4.3
   Tp-link ≫ Er7212pc Version 2.0
Tp-link ≫ Er605 Firmware Version < 2.4.4
   Tp-link ≫ Er605 Version 2.0
Tp-link ≫ Er7206 Firmware Version < 2.3.5
   Tp-link ≫ Er7206 Version 2.0
Tp-link ≫ Er7406 Firmware Version < 1.3.4
   Tp-link ≫ Er7406 Version -
Tp-link ≫ Er707-m2 Firmware Version < 1.4.4
   Tp-link ≫ Er707-m2 Version -
Tp-link ≫ Er7412-m2 Firmware Version < 1.2.0
   Tp-link ≫ Er7412-m2 Version -
Tp-link ≫ Er8411 Firmware Version < 1.4.1
   Tp-link ≫ Er8411 Version -
Tp-link ≫ Er706w Firmware Version < 1.2.11
   Tp-link ≫ Er706w Version -
Tp-link ≫ Er706w-4g Firmware Version < 1.2.6
   Tp-link ≫ Er706w-4g Version -
Tp-link ≫ Er706w-4g Firmware Version < 2.1.11
   Tp-link ≫ Er706w-4g Version 2.0
Tp-link ≫ Er706wp-4g Firmware Version < 1.1.11
   Tp-link ≫ Er706wp-4g Version -
Tp-link ≫ Er703wp-4g-outdoor Firmware Version < 1.1.7
   Tp-link ≫ Er703wp-4g-outdoor Version -
Tp-link ≫ Dr3220v-4g Firmware Version < 1.2.0
   Tp-link ≫ Dr3220v-4g Version -
Tp-link ≫ Dr3650v Firmware Version < 1.2.0
   Tp-link ≫ Dr3650v Version -
Tp-link ≫ Dr3650v-4g Firmware Version < 1.2.0
   Tp-link ≫ Dr3650v-4g Version -
Tp-link ≫ Er603wp-4g-outdoor Firmware Version < 1.0.2
   Tp-link ≫ Er603wp-4g-outdoor Version -
Tp-link ≫ Dr3150 Firmware Version < 1.0.1
   Tp-link ≫ Dr3150 Version -
Tp-link ≫ Er701-5g-outdoor Firmware Version < 1.0.3
   Tp-link ≫ Er701-5g-outdoor Version -
Tp-link ≫ Er605w Firmware Version < 2.0.4
   Tp-link ≫ Er605w Version 2.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 2.8 1.4
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
f23511db-6c3e-4e32-a477-6aa17d310630 6 0 0
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
25.08.2026 11:30
https://www.omadanetworks.com/us/support/download/
Product
https://www.omadanetworks.com/en/support/download/
Product
https://www.tp-link.com/us/support/faq/5256/
Vendor Advisory