CVE-2026-9033

Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways

MEDIUM

4.3

CVSS Score

Published: August 20, 2026 at 06:31 PM UTC

Updated: October 26, 2026 at 10:10 AM UTC

36 products affected across 1 vendorER7212PC FirmwareEr707-m2 FirmwareER706W 4G Firmware· also runs on 18 platforms

Using ER7212PC v2 by TP-Link Systems Inc.?

Get instant alerts when new vulnerabilities affect ER7212PC v2 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM4.3

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access. Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

DR3150 Firmware · TP-Link

95%

v < 1.0.1

Affected range stops below 1.0.1, so it looks safe — our inference, not a vendor statement

tp-link-dr3150 (same device)

DR3220V 4G Firmware · TP-Link

95%

v < 1.2.0

Affected range stops below 1.2.0, so it looks safe — our inference, not a vendor statement

tp-link-dr3220v-4g (same device)

DR3650V 4G Firmware · TP-Link

95%

v < 1.2.0

Affected range stops below 1.2.0, so it looks safe — our inference, not a vendor statement

tp-link-dr3650v-4g (same device)

DR3650V Firmware · TP-Link

95%

v < 1.2.0

Affected range stops below 1.2.0, so it looks safe — our inference, not a vendor statement

tp-link-dr3650v (same device)

ER603WP 4G Outdoor Firmware · TP-Link

95%

v < 1.0.2

Affected range stops below 1.0.2, so it looks safe — our inference, not a vendor statement

tp-link-er603wp-4g-outdoor (same device)

ER605 Firmware · TP-Link

95%

v < 2.4.4

Affected range stops below 2.4.4, so it looks safe — our inference, not a vendor statement

tp-link-er605 (same device)

ER605W Firmware · TP-Link

95%

v < 2.0.4

Affected range stops below 2.0.4, so it looks safe — our inference, not a vendor statement

tp-link-er605w (same device)

Er701-5g Outdoor Firmware · TP-Link

95%

v < 1.0.3

Affected range stops below 1.0.3, so it looks safe — our inference, not a vendor statement

tp-link-er701-5g-outdoor (same device)

ER703WP 4G Outdoor Firmware · TP-Link

95%

v < 1.1.7

Affected range stops below 1.1.7, so it looks safe — our inference, not a vendor statement

tp-link-er703wp-4g-outdoor (same device)

ER706W 4G Firmware · TP-Link

95%

v < 1.2.6v < 2.1.11

Affected range stops below 1.2.6, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.1.11, so it looks safe — our inference, not a vendor statement

tp-link-er706w-4g (same device)

Runs on — not affected

The affected product only carries this flaw when running on these platforms. The platforms themselves are not vulnerable.

DR3150 · TP-Link

95%

Affected range stops below 1.0.1 Build 20260722 Rel.16854, so it looks safe — our inference, not a vendor statement

DR3220v-4G · TP-Link

95%

Affected range stops below 1.2.0 Build 20260630 Rel.82652, so it looks safe — our inference, not a vendor statement

DR3650v · TP-Link

95%

Affected range stops below 1.2.0 Build 20260630 Rel.83311, so it looks safe — our inference, not a vendor statement

DR3650v-4G · TP-Link

95%

Affected range stops below 1.2.0 Build 20260630 Rel.83347, so it looks safe — our inference, not a vendor statement

ER603WP-4G-Outdoor · TP-Link

95%

Affected range stops below 1.0.2 Build 20260723 Rel.43271, so it looks safe — our inference, not a vendor statement

ER605 · TP-Link

95%

Affected range stops below 2.4.4 Build 20260630 Rel.14398, so it looks safe — our inference, not a vendor statement

ER605W · TP-Link

95%

Affected range stops below 2.0.4 Build 20260723 Rel.43763, so it looks safe — our inference, not a vendor statement

ER701-5G-Outdoor · TP-Link

95%

Affected range stops below 1.0.3 Build 20260723 Rel.40931, so it looks safe — our inference, not a vendor statement

ER703WP-4G-Outdoor · TP-Link

95%

Affected range stops below 1.1.7 Build 20260723 Rel.41712, so it looks safe — our inference, not a vendor statement

ER706W · TP-Link

95%

Affected range stops below 1.2.11 Build 20260723 Rel.41567, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (3)

PatchProduct

Source: cverecord

https://www.omadanetworks.com/en/support/download/

PatchProduct

Source: cverecord

https://www.omadanetworks.com/us/support/download/

Vendor Advisory

Source: cverecord

https://www.tp-link.com/us/support/faq/5256/

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

4.3MEDIUM[email protected]

Attack Vector: ADJACENT_NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: NONE
Integrity: NONE
Availability: LOW

Vector?

Quick Info

StatusANALYZED

CWE

CWE-306

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card