Read the docs
TI-2026-07940 Aliases CVE-2026-9033GHSA-fpm4-hq62-cqf6

Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways

Priority LOW 27CWE-306Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access.  Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00277 20th percentileScored 2026-11-07
Fix Fixed ER7212PC v2 (TP-Link Systems Inc.): 2.4.3 Build 20260722 Rel.40250ER605 v2 (TP-Link Systems Inc.): 2.4.4 Build 20260630 Rel.14398+17 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkER7212PC v2before 2.4.3 Build 20260722 Rel.402502.4.3 Build 20260722 Rel.40250Patch availableCNA
TP-LinkER605 v2before 2.4.4 Build 20260630 Rel.143982.4.4 Build 20260630 Rel.14398Patch availableCNA
TP-LinkER7206 v2before 2.3.5 Build 20260625 Rel.431362.3.5 Build 20260625 Rel.43136Patch availableCNA
TP-LinkER7406 v1before 1.3.4 Build 20260625 Rel.431361.3.4 Build 20260625 Rel.43136Patch availableCNA
TP-LinkER707-M2 v1before 1.4.4 Build 20260625 Rel.430631.4.4 Build 20260625 Rel.43063Patch availableCNA
TP-LinkER7412-M2 v1before 1.2.0 Build 20260630 Rel.829471.2.0 Build 20260630 Rel.82947Patch availableCNA
TP-LinkER8411 v1before 1.4.1 Build 20260708 Rel.648321.4.1 Build 20260708 Rel.64832Patch availableCNA
TP-LinkER706W v1before 1.2.11 Build 20260723 Rel.415671.2.11 Build 20260723 Rel.41567Patch availableCNA
TP-LinkER706W-4G v1before 1.2.6 Build 20260723 Rel.413211.2.6 Build 20260723 Rel.41321Patch availableCNA
TP-LinkER706W-4G v2before 2.1.11 Build 20260723 Rel.416242.1.11 Build 20260723 Rel.41624Patch availableCNA
TP-LinkER706WP-4G v1before 1.1.11 Build 20260723 Rel.416241.1.11 Build 20260723 Rel.41624Patch availableCNA
TP-LinkER703WP-4G-Outdoor v1before 1.1.7 Build 20260723 Rel.417121.1.7 Build 20260723 Rel.41712Patch availableCNA
TP-LinkDR3220v-4G v1before 1.2.0 Build 20260630 Rel.826521.2.0 Build 20260630 Rel.82652Patch availableCNA
TP-LinkDR3650v v1before 1.2.0 Build 20260630 Rel.833111.2.0 Build 20260630 Rel.83311Patch availableCNA
TP-LinkDR3650v-4G v1before 1.2.0 Build 20260630 Rel.833471.2.0 Build 20260630 Rel.83347Patch availableCNA
TP-LinkER603WP-4G-Outdoor v1before 1.0.2 Build 20260723 Rel.432711.0.2 Build 20260723 Rel.43271Patch availableCNA
TP-LinkDR3150 v1before 1.0.1 Build 20260722 Rel.168541.0.1 Build 20260722 Rel.16854Patch availableCNA
TP-LinkER701-5G-Outdoor v1before 1.0.3 Build 20260723 Rel.409311.0.3 Build 20260723 Rel.40931Patch availableCNA
TP-LinkER605W v2before 2.0.4 Build 20260723 Rel.437632.0.4 Build 20260723 Rel.43763Patch availableCNA
  • ER7212PC v2 VendorTP-Link Affected before 2.4.3 Build 20260722 Rel.40250 Fixed in 2.4.3 Build 20260722 Rel.40250 Patch available CNA
  • ER605 v2 VendorTP-Link Affected before 2.4.4 Build 20260630 Rel.14398 Fixed in 2.4.4 Build 20260630 Rel.14398 Patch available CNA
  • ER7206 v2 VendorTP-Link Affected before 2.3.5 Build 20260625 Rel.43136 Fixed in 2.3.5 Build 20260625 Rel.43136 Patch available CNA
  • ER7406 v1 VendorTP-Link Affected before 1.3.4 Build 20260625 Rel.43136 Fixed in 1.3.4 Build 20260625 Rel.43136 Patch available CNA
  • ER707-M2 v1 VendorTP-Link Affected before 1.4.4 Build 20260625 Rel.43063 Fixed in 1.4.4 Build 20260625 Rel.43063 Patch available CNA
  • ER7412-M2 v1 VendorTP-Link Affected before 1.2.0 Build 20260630 Rel.82947 Fixed in 1.2.0 Build 20260630 Rel.82947 Patch available CNA
  • ER8411 v1 VendorTP-Link Affected before 1.4.1 Build 20260708 Rel.64832 Fixed in 1.4.1 Build 20260708 Rel.64832 Patch available CNA
  • ER706W v1 VendorTP-Link Affected before 1.2.11 Build 20260723 Rel.41567 Fixed in 1.2.11 Build 20260723 Rel.41567 Patch available CNA
  • ER706W-4G v1 VendorTP-Link Affected before 1.2.6 Build 20260723 Rel.41321 Fixed in 1.2.6 Build 20260723 Rel.41321 Patch available CNA
  • ER706W-4G v2 VendorTP-Link Affected before 2.1.11 Build 20260723 Rel.41624 Fixed in 2.1.11 Build 20260723 Rel.41624 Patch available CNA
  • ER706WP-4G v1 VendorTP-Link Affected before 1.1.11 Build 20260723 Rel.41624 Fixed in 1.1.11 Build 20260723 Rel.41624 Patch available CNA
  • ER703WP-4G-Outdoor v1 VendorTP-Link Affected before 1.1.7 Build 20260723 Rel.41712 Fixed in 1.1.7 Build 20260723 Rel.41712 Patch available CNA
  • DR3220v-4G v1 VendorTP-Link Affected before 1.2.0 Build 20260630 Rel.82652 Fixed in 1.2.0 Build 20260630 Rel.82652 Patch available CNA
  • DR3650v v1 VendorTP-Link Affected before 1.2.0 Build 20260630 Rel.83311 Fixed in 1.2.0 Build 20260630 Rel.83311 Patch available CNA
  • DR3650v-4G v1 VendorTP-Link Affected before 1.2.0 Build 20260630 Rel.83347 Fixed in 1.2.0 Build 20260630 Rel.83347 Patch available CNA
  • ER603WP-4G-Outdoor v1 VendorTP-Link Affected before 1.0.2 Build 20260723 Rel.43271 Fixed in 1.0.2 Build 20260723 Rel.43271 Patch available CNA
  • DR3150 v1 VendorTP-Link Affected before 1.0.1 Build 20260722 Rel.16854 Fixed in 1.0.1 Build 20260722 Rel.16854 Patch available CNA
  • ER701-5G-Outdoor v1 VendorTP-Link Affected before 1.0.3 Build 20260723 Rel.40931 Fixed in 1.0.3 Build 20260723 Rel.40931 Patch available CNA
  • ER605W v2 VendorTP-Link Affected before 2.0.4 Build 20260723 Rel.43763 Fixed in 2.0.4 Build 20260723 Rel.43763 Patch available CNA

CPE configurations NVD · 38

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:er7212pc_firmware:*:*:*:*:*:*:*:*before 2.4.3VulnerableTP-Link
cpe:2.3:h:tp-link:er7212pc:2.0:*:*:*:*:*:*:*2.0Running onTP-Link
cpe:2.3:o:tp-link:er605_firmware:*:*:*:*:*:*:*:*before 2.4.4VulnerableTP-Link
cpe:2.3:h:tp-link:er605:2.0:*:*:*:*:*:*:*2.0Running onTP-Link
cpe:2.3:o:tp-link:er7206_firmware:*:*:*:*:*:*:*:*before 2.3.5VulnerableTP-Link
cpe:2.3:h:tp-link:er7206:2.0:*:*:*:*:*:*:*2.0Running onTP-Link
cpe:2.3:o:tp-link:er7406_firmware:*:*:*:*:*:*:*:*before 1.3.4VulnerableTP-Link
cpe:2.3:h:tp-link:er7406:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er707-m2_firmware:*:*:*:*:*:*:*:*before 1.4.4VulnerableTP-Link
cpe:2.3:h:tp-link:er707-m2:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
  • cpe:2.3:o:tp-link:er7212pc_firmware:*:*:*:*:*:*:*:* Versions before 2.4.3 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er7212pc:2.0:*:*:*:*:*:*:* Versions 2.0 Running on ·TP-Link
  • cpe:2.3:o:tp-link:er605_firmware:*:*:*:*:*:*:*:* Versions before 2.4.4 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er605:2.0:*:*:*:*:*:*:* Versions 2.0 Running on ·TP-Link
  • cpe:2.3:o:tp-link:er7206_firmware:*:*:*:*:*:*:*:* Versions before 2.3.5 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er7206:2.0:*:*:*:*:*:*:* Versions 2.0 Running on ·TP-Link
  • cpe:2.3:o:tp-link:er7406_firmware:*:*:*:*:*:*:*:* Versions before 1.3.4 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er7406:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er707-m2_firmware:*:*:*:*:*:*:*:* Versions before 1.4.4 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er707-m2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
Show 28 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:tp-link:er7412-m2_firmware:*:*:*:*:*:*:*:*before 1.2.0VulnerableTP-Link
cpe:2.3:h:tp-link:er7412-m2:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er8411_firmware:*:*:*:*:*:*:*:*before 1.4.1VulnerableTP-Link
cpe:2.3:h:tp-link:er8411:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er706w_firmware:*:*:*:*:*:*:*:*before 1.2.11VulnerableTP-Link
cpe:2.3:h:tp-link:er706w:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er706w-4g_firmware:*:*:*:*:*:*:*:*before 1.2.6VulnerableTP-Link
cpe:2.3:h:tp-link:er706w-4g:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er706w-4g_firmware:*:*:*:*:*:*:*:*before 2.1.11VulnerableTP-Link
cpe:2.3:h:tp-link:er706w-4g:2.0:*:*:*:*:*:*:*2.0Running onTP-Link
cpe:2.3:o:tp-link:er706wp-4g_firmware:*:*:*:*:*:*:*:*before 1.1.11VulnerableTP-Link
cpe:2.3:h:tp-link:er706wp-4g:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er703wp-4g-outdoor_firmware:*:*:*:*:*:*:*:*before 1.1.7VulnerableTP-Link
cpe:2.3:h:tp-link:er703wp-4g-outdoor:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:dr3220v-4g_firmware:*:*:*:*:*:*:*:*before 1.2.0VulnerableTP-Link
cpe:2.3:h:tp-link:dr3220v-4g:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:dr3650v_firmware:*:*:*:*:*:*:*:*before 1.2.0VulnerableTP-Link
cpe:2.3:h:tp-link:dr3650v:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:dr3650v-4g_firmware:*:*:*:*:*:*:*:*before 1.2.0VulnerableTP-Link
cpe:2.3:h:tp-link:dr3650v-4g:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er603wp-4g-outdoor_firmware:*:*:*:*:*:*:*:*before 1.0.2VulnerableTP-Link
cpe:2.3:h:tp-link:er603wp-4g-outdoor:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:dr3150_firmware:*:*:*:*:*:*:*:*before 1.0.1VulnerableTP-Link
cpe:2.3:h:tp-link:dr3150:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er701-5g-outdoor_firmware:*:*:*:*:*:*:*:*before 1.0.3VulnerableTP-Link
cpe:2.3:h:tp-link:er701-5g-outdoor:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
cpe:2.3:o:tp-link:er605w_firmware:*:*:*:*:*:*:*:*before 2.0.4VulnerableTP-Link
cpe:2.3:h:tp-link:er605w:2.0:*:*:*:*:*:*:*2.0Running onTP-Link
  • cpe:2.3:o:tp-link:er7412-m2_firmware:*:*:*:*:*:*:*:* Versions before 1.2.0 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er7412-m2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er8411_firmware:*:*:*:*:*:*:*:* Versions before 1.4.1 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er8411:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er706w_firmware:*:*:*:*:*:*:*:* Versions before 1.2.11 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er706w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er706w-4g_firmware:*:*:*:*:*:*:*:* Versions before 1.2.6 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er706w-4g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er706w-4g_firmware:*:*:*:*:*:*:*:* Versions before 2.1.11 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er706w-4g:2.0:*:*:*:*:*:*:* Versions 2.0 Running on ·TP-Link
  • cpe:2.3:o:tp-link:er706wp-4g_firmware:*:*:*:*:*:*:*:* Versions before 1.1.11 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er706wp-4g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er703wp-4g-outdoor_firmware:*:*:*:*:*:*:*:* Versions before 1.1.7 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er703wp-4g-outdoor:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:dr3220v-4g_firmware:*:*:*:*:*:*:*:* Versions before 1.2.0 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:dr3220v-4g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:dr3650v_firmware:*:*:*:*:*:*:*:* Versions before 1.2.0 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:dr3650v:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:dr3650v-4g_firmware:*:*:*:*:*:*:*:* Versions before 1.2.0 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:dr3650v-4g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er603wp-4g-outdoor_firmware:*:*:*:*:*:*:*:* Versions before 1.0.2 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er603wp-4g-outdoor:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:dr3150_firmware:*:*:*:*:*:*:*:* Versions before 1.0.1 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:dr3150:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er701-5g-outdoor_firmware:*:*:*:*:*:*:*:* Versions before 1.0.3 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er701-5g-outdoor:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link
  • cpe:2.3:o:tp-link:er605w_firmware:*:*:*:*:*:*:*:* Versions before 2.0.4 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:er605w:2.0:*:*:*:*:*:*:* Versions 2.0 Running on ·TP-Link

Remediation

  • Fix · CNA ER7212PC v2 (TP-Link Systems Inc.) Fixed in 2.4.3 Build 20260722 Rel.40250
  • Fix · CNA ER605 v2 (TP-Link Systems Inc.) Fixed in 2.4.4 Build 20260630 Rel.14398
  • Fix · CNA ER7206 v2 (TP-Link Systems Inc.) Fixed in 2.3.5 Build 20260625 Rel.43136
  • Fix · CNA ER7406 v1 (TP-Link Systems Inc) Fixed in 1.3.4 Build 20260625 Rel.43136
  • Fix · CNA ER707-M2 v1 (TP-Link Systems Inc.) Fixed in 1.4.4 Build 20260625 Rel.43063
  • Fix · CNA ER7412-M2 v1 (TP-Link Systems Inc) Fixed in 1.2.0 Build 20260630 Rel.82947
  • Fix · CNA ER8411 v1 (TP-Link Systems Inc.) Fixed in 1.4.1 Build 20260708 Rel.64832
  • Fix · CNA ER706W v1 (TP-Link Systems Inc.) Fixed in 1.2.11 Build 20260723 Rel.41567
  • Fix · CNA ER706W-4G v1 (TP-Link Systems Inc.) Fixed in 1.2.6 Build 20260723 Rel.41321
  • Fix · CNA ER706W-4G v2 (TP-Link Systems Inc.) Fixed in 2.1.11 Build 20260723 Rel.41624
  • Fix · CNA ER706WP-4G v1 (TP-Link Systems Inc.) Fixed in 1.1.11 Build 20260723 Rel.41624
  • Fix · CNA ER703WP-4G-Outdoor v1 (TP-Link Systems Inc.) Fixed in 1.1.7 Build 20260723 Rel.41712
  • Fix · CNA DR3220v-4G v1 (TP-Link Systems Inc.) Fixed in 1.2.0 Build 20260630 Rel.82652
  • Fix · CNA DR3650v v1 (TP-Link Systems Inc.) Fixed in 1.2.0 Build 20260630 Rel.83311
  • Fix · CNA DR3650v-4G v1 (TP-Link Systems Inc.) Fixed in 1.2.0 Build 20260630 Rel.83347
  • Fix · CNA ER603WP-4G-Outdoor v1 (TP-Link Systems Inc.) Fixed in 1.0.2 Build 20260723 Rel.43271
  • Fix · CNA DR3150 v1 (TP-Link Systems Inc.) Fixed in 1.0.1 Build 20260722 Rel.16854
  • Fix · CNA ER701-5G-Outdoor v1 (TP-Link Systems Inc.) Fixed in 1.0.3 Build 20260723 Rel.40931
  • Fix · CNA ER605W v2 (TP-Link Systems Inc.) Fixed in 2.0.4 Build 20260723 Rel.43763

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    TP-Link Systems DR3150 v1, DR3220v-4G v1 and 16 more products — tp-link.com/us/support/faq/5256

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-15915 Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada GatewaysPriority MEDIUM 57
    • TI-2026-15976 Unencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada GatewaysPriority LOW 28
    Show all 3 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-9033
  2. 2026-10-03 Alias added: GHSA-fpm4-hq62-cqf6

References

Patch 2

Advisory 1

  • TI-2026-15915 Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways CVSS 4.0CRITICAL 9.3
  • TI-2026-15976 Unencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada Gateways CVSS 4.0MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences