CVEvulnerability
CVE-2026-9033
6.0 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2026-08-20
- Last modified
- 2026-10-26
- Assigner
- f23511db-6c3e-4e32-a477-6aa17d310630
- CVSS 4.0 (f23511db-6c3e-4e32-a477-6aa17d310630)
- 6.0 MEDIUM — CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weaknesses
- CWE-306
Description
An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access.
Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.
Affected configurations
• tp-link er7212pc firmware (< 2.4.3)
• tp-link er605 firmware (< 2.4.4)
• tp-link er7206 firmware (< 2.3.5)
• tp-link er7406 firmware (< 1.3.4)
• tp-link er707-m2 firmware (< 1.4.4)
• tp-link er7412-m2 firmware (< 1.2.0)
• tp-link er8411 firmware (< 1.4.1)
• tp-link er706w firmware (< 1.2.11)
• tp-link er706w-4g firmware (< 1.2.6)
• tp-link er706w-4g firmware (< 2.1.11)
• tp-link er706wp-4g firmware (< 1.1.11)
• tp-link er703wp-4g-outdoor firmware (< 1.1.7)
• tp-link dr3220v-4g firmware (< 1.2.0)
• tp-link dr3650v firmware (< 1.2.0)
• tp-link dr3650v-4g firmware (< 1.2.0)
• tp-link er603wp-4g-outdoor firmware (< 1.0.2)
• tp-link dr3150 firmware (< 1.0.1)
• tp-link er701-5g-outdoor firmware (< 1.0.3)
• tp-link er605w firmware (< 2.0.4)
Related
Weakness · CWE (1)
- CWE-306 Missing Authentication for Critical Functionality weakness