Er706W 4G V1
Monthly
Captive portal session management across multiple TP-Link Omada ER and DR series routers exposes unauthenticated session-termination functions to any attacker with adjacent network access, allowing forced logout of specific users or full session clearance without credentials. Nineteen hardware models running firmware prior to late June-July 2026 builds are confirmed affected per EUVD data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low attack complexity combined with zero authentication requirements makes adjacent-network exploitation straightforward once an attacker is positioned on the same network segment as the captive portal service.
Captive portal session management across multiple TP-Link Omada ER and DR series routers exposes unauthenticated session-termination functions to any attacker with adjacent network access, allowing forced logout of specific users or full session clearance without credentials. Nineteen hardware models running firmware prior to late June-July 2026 builds are confirmed affected per EUVD data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low attack complexity combined with zero authentication requirements makes adjacent-network exploitation straightforward once an attacker is positioned on the same network segment as the captive portal service.