Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.4.3 Build 20260722 Rel.40250, 2.4.4 Build 20260630 Rel.14398, 2.3.5 Build 20260625 Rel.43136, 1.3.4 Build 20260625 Rel.43136, 1.4.4 Build 20260625 Rel.43063, and 14 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access. Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- TP-Link Systems Inc. ER7212PC v2
fixed in 2.4.3 Build 20260722 Rel.40250
- TP-Link Systems Inc. ER605 v2
fixed in 2.4.4 Build 20260630 Rel.14398
- TP-Link Systems Inc. ER7206 v2
fixed in 2.3.5 Build 20260625 Rel.43136
- TP-Link Systems Inc ER7406 v1
fixed in 1.3.4 Build 20260625 Rel.43136
- TP-Link Systems Inc. ER707-M2 v1
fixed in 1.4.4 Build 20260625 Rel.43063
- TP-Link Systems Inc ER7412-M2 v1
fixed in 1.2.0 Build 20260630 Rel.82947
- TP-Link Systems Inc. ER8411 v1
fixed in 1.4.1 Build 20260708 Rel.64832
- TP-Link Systems Inc. ER706W v1
fixed in 1.2.11 Build 20260723 Rel.41567
- TP-Link Systems Inc. ER706W-4G v1
fixed in 1.2.6 Build 20260723 Rel.41321
- TP-Link Systems Inc. ER706W-4G v2
fixed in 2.1.11 Build 20260723 Rel.41624
- TP-Link Systems Inc. ER706WP-4G v1
fixed in 1.1.11 Build 20260723 Rel.41624
- TP-Link Systems Inc. ER703WP-4G-Outdoor v1
fixed in 1.1.7 Build 20260723 Rel.41712
- TP-Link Systems Inc. DR3220v-4G v1
fixed in 1.2.0 Build 20260630 Rel.82652
- TP-Link Systems Inc. DR3650v v1
fixed in 1.2.0 Build 20260630 Rel.83311
- TP-Link Systems Inc. DR3650v-4G v1
fixed in 1.2.0 Build 20260630 Rel.83347
- TP-Link Systems Inc. ER603WP-4G-Outdoor v1
fixed in 1.0.2 Build 20260723 Rel.43271
- TP-Link Systems Inc. DR3150 v1
fixed in 1.0.1 Build 20260722 Rel.16854
- TP-Link Systems Inc. ER701-5G-Outdoor v1
fixed in 1.0.3 Build 20260723 Rel.40931
- TP-Link Systems Inc. ER605W v2
fixed in 2.0.4 Build 20260723 Rel.43763