TP-Link Omada CVE-2026-9033

The captive portal feature must be enabled on the affected device - this is a deployable feature, not always active by default, so devices not using captive portal are not exposed. The attacker must have adjacent network access (AV:A per CVSS 4.0), meaning they must be on the same broadcast domain, VLAN, or directly connected network segment as the captive portal service interface - remote internet-based attackers cannot reach it without this adjacency. AT:P in the CVSS 4.0 vector confirms this specific network positioning requirement. No authentication is required once adjacency is established (PR:N). No user interaction is needed. Exploitation is limited to availability impact only - confidentiality and integrity of data are not affected. The vulnerability does not grant access to network resources, credentials, or device configuration; it only disrupts active portal sessions.

The CVSS 4.0 base score of 6.0 with vector AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N accurately reflects the threat profile. The adjacent-network attack vector (AV:A) is the dominant risk-limiting factor: exploitation requires the attacker to be on the same broadcast domain, VLAN, or directly connected network segment as the captive portal service - a credential-less internet attacker cannot trigger this remotely. The AT:P modifier further refines this by acknowledging the specific network position prerequisite. Impact is purely availability (VA:H with no confidentiality or integrity breach), meaning confidential data is not exposed and network configurations cannot be altered. No KEV listing and no public exploit code have been identified at time of analysis, keeping real-world exploitation risk moderate rather than critical despite the trivial technical complexity once the adjacency requirement is met. The primary concern is guest-network or enterprise-edge disruption: a malicious user already on the guest VLAN could repeatedly clear captive portal sessions to deny service to all other users on that segment. EPSS data was not provided in the input and cannot be inferred.

An attacker who gains access to the guest Wi-Fi or adjacent network segment served by a captive portal on a vulnerable Omada router sends unauthenticated HTTP requests targeting the captive portal session management endpoint, forcing termination of all active user sessions. All connected users are immediately logged out of the captive portal and must re-authenticate to regain internet access. No public exploit code has been identified, but the attack requires only basic HTTP request crafting against the local portal endpoint - no credentials or special tooling needed.