Skip to main content

TP-Link Omada EUVDEUVD-2026-63543

| CVE-2026-9033 MEDIUM
Missing Authentication for Critical Function (CWE-306)
2026-08-20 TPLink GHSA-fpm4-hq62-cqf6
Authentication Bypass Er7212Pc V2 Er605 V2 Er7206 V2 Er7406 V1 Er707 M2 V1 Er7412 M2 V1 Er8411 V1 Er706W V1 Er706W 4G V1 Er706W 4G V2 Er706Wp 4G V1 Er703Wp 4G Outdoor V1 Dr3220V 4G V1 Dr3650V V1 Dr3650V 4G V1 Er603Wp 4G Outdoor V1 Dr3150 V1 Er701 5G Outdoor V1 Er605W V2
6.0
CVSS 4.0 · Vendor: TPLink
Share

Severity by source

Vendor (TPLink) PRIMARY
6.0 MEDIUM
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Adjacent-network access with no authentication required; impact is solely high availability via uncontrolled session termination; no confidentiality or integrity breach occurs.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TPLink).

CVSS VectorVendor: TPLink

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Aug 20, 2026 - 19:43 vuln.today

DescriptionCVE.org

An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access.

Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.

AnalysisAI

Captive portal session management across multiple TP-Link Omada ER and DR series routers exposes unauthenticated session-termination functions to any attacker with adjacent network access, allowing forced logout of specific users or full session clearance without credentials. Nineteen hardware models running firmware prior to late June-July 2026 builds are confirmed affected per EUVD data. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Gain adjacent network access to captive portal segment
Delivery
Identify captive portal service endpoint
Exploit
Send unauthenticated session termination request
Execution
All active portal sessions cleared
Persist
Affected users forced to re-authenticate
Impact
Repeated requests maintain denial-of-service condition
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The captive portal feature must be enabled on the affected device - this is a deployable feature, not always active by default, so devices not using captive portal are not exposed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 6.0 with vector AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N accurately reflects the threat profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who gains access to the guest Wi-Fi or adjacent network segment served by a captive portal on a vulnerable Omada router sends unauthenticated HTTP requests targeting the captive portal session management endpoint, forcing termination of all active user sessions. All connected users are immediately logged out of the captive portal and must re-authenticate to regain internet access. …
Remediation The primary fix is to upgrade firmware on all affected Omada ER and DR series devices to the patched builds listed in the EUVD data, all dated between June 25 and July 23, 2026. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Er7212Pc V2

View all
CVE-2026-19586 CRITICAL
9.3 Aug 20

Pre-authentication OS command injection in TP-Link Omada gateways (ER-series and DR-series VPN routers) lets an unauthen
CVE-2026-19683 MEDIUM
6.3 Aug 20

Cleartext transmission of DDNS authentication credentials in TP-Link Omada business gateway routers exposes sensitive ac

Same weakness CWE-306 – Missing Authentication for Critical Function

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2017-10271 HIGH POC
7.5
CVE-2025-3248 CRITICAL POC
9.8
CVE-2024-11680 CRITICAL POC
9.8
CVE-2024-51567 CRITICAL POC
9.8
CVE-2025-0108 HIGH POC
8.8
CVE-2025-32433 CRITICAL POC
10.0
CVE-2016-2004 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-63543 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy