6.0
MEDIUM CVSS 4.0
CVE-2026-9033
Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways
Description

An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access.  Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.

INFO

Published Date :

Aug. 20, 2026, 7:17 p.m.

Last Modified :

Aug. 20, 2026, 7:17 p.m.

Remotely Exploit :

No

Source :

f23511db-6c3e-4e32-a477-6aa17d310630
Affected Products

The following products are affected by CVE-2026-9033 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Tp-link er7206
2 Tp-link er8411
3 Tp-link er7412-m2
4 Tp-link er707-m2
5 Tp-link er605
6 Tp-link er706w
7 Tp-link er706w-4g
8 Tp-link er7212pc
9 Tp-link er7406
10 Tp-link er706wp-4g
11 Tp-link er703wp-4g-outdoor
12 Tp-link dr3220v-4g
13 Tp-link dr3650v-4g
14 Tp-link dr3650v
15 Tp-link er701-5g-outdoor
16 Tp-link er605w
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 134c704f-9b21-4f2e-91b3-4a467353bcc0
CVSS 4.0 MEDIUM f23511db-6c3e-4e32-a477-6aa17d310630
CVSS 4.0 MEDIUM f23511db-6c3e-4e32-a477-6aa17d310630
Solution
Disable captive portal session termination to prevent DoS and re-authentication requirements.
  • Disable captive portal session termination functionality.
  • Restrict network access to the captive portal service.
  • Apply vendor security updates when available.
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-9033.

URL Resource
https://www.omadanetworks.com/en/support/download/
https://www.omadanetworks.com/us/support/download/
https://www.tp-link.com/us/support/faq/5256/
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-9033 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-9033 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-9033 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • New CVE Received by f23511db-6c3e-4e32-a477-6aa17d310630

    Aug. 20, 2026

    Action Type Old Value New Value
    Added Affected [{'vendor': 'TP-Link Systems Inc.', 'product': 'ER7212PC v2', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '2.4.3 Build 20260722 Rel.40250', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}, {'vendor': 'TP-Link Systems Inc.', 'product': 'ER605 v2', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '2.4.4 Build 20260630 Rel.14398', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}, {'vendor': 'TP-Link Systems Inc.', 'product': 'ER7206 v2', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '2.3.5 Build 20260625 Rel.43136', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}, {'vendor': 'TP-Link Systems Inc', 'product': 'ER7406 v1', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '1.3.4 Build 20260625 Rel.43136', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}, {'vendor': 'TP-Link Systems Inc.', 'product': 'ER707-M2 v1', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '1.4.4 Build 20260625 Rel.43063', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}, {'vendor': 'TP-Link Systems Inc', 'product': 'ER7412-M2 v1', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '1.2.0 Build 20260630 Rel.82947', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}, {'vendor': 'TP-Link Systems Inc.', 'product': 'ER8411 v1', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '1.4.1 Build 20260708 Rel.64832', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}, {'vendor': 'TP-Link Systems Inc.', 'product': 'ER706W v1', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '1.2.11 Build 20260723 Rel.41567', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}, {'vendor': 'TP-Link Systems Inc.', 'product': 'ER706W-4G v1', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '1.2.6 Build 20260723 Rel.41321', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}, {'vendor': 'TP-Link Systems Inc.', 'product': 'ER706W-4G v2', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '2.1.11 Build 20260723 Rel.41624', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}, {'vendor': 'TP-Link Systems Inc.', 'product': 'ER706WP-4G v1', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '1.1.11 Build 20260723 Rel.41624', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}, {'vendor': 'TP-Link Systems Inc.', 'product': 'ER703WP-4G-Outdoor v1', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '1.1.7 Build 20260723 Rel.41712', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}, {'vendor': 'TP-Link Systems Inc.', 'product': 'DR3220v-4G v1', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '1.2.0 Build 20260630 Rel.82652', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}, {'vendor': 'TP-Link Systems Inc.', 'product': 'DR3650v v1', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '1.2.0 Build 20260630 Rel.83311', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}, {'vendor': 'TP-Link Systems Inc.', 'product': 'DR3650v-4G v1', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '1.2.0 Build 20260630 Rel.83347', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}, {'vendor': 'TP-Link Systems Inc.', 'product': 'ER603WP-4G-Outdoor v1', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '1.0.2 Build 20260723 Rel.43271', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}, {'vendor': 'TP-Link Systems Inc.', 'product': 'DR3150 v1', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '1.0.1 Build 20260722 Rel.16854', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}, {'vendor': 'TP-Link Systems Inc.', 'product': 'ER701-5G-Outdoor v1', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '1.0.3 Build 20260723 Rel.40931', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}, {'vendor': 'TP-Link Systems Inc.', 'product': 'ER605W v2', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '2.0.4 Build 20260723 Rel.43763', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}]
    Added Description An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access.  Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.
    Added CVSS V4.0 AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
    Added CWE CWE-306
    Added Reference https://www.omadanetworks.com/en/support/download/
    Added Reference https://www.omadanetworks.com/us/support/download/
    Added Reference https://www.tp-link.com/us/support/faq/5256/
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Aug. 20, 2026

    Action Type Old Value New Value
    Added SSVC {'id': 'CVE-2026-9033', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-20T18:59:29.032581Z'}
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.