Here is the screenshot of the login page once the oc200 got offline, and I think its because of the power cable, both the oc200 and eap225-outdoor are plug to my tplink WR720N router.

Once they check the "I accept" and log in they can now access the internet.

Hi Guys,

Some more updates, I think some customers think that its a hack or bug in the voucher system that they been trying to find ways to exploit it and one is that they try to flood the voucher login / oc200 with "... authentication failed when connected to SSID..." and hoping to get to the default login page for them to have access to free internet access. I've been checking the logs and found several attempts. I did block them but its time consuming to check the logs. Is there any way to limit their attempts? like after 5 failed attempts, wait for 1min or something like that? or a autoban for those clients who flood the voucher system with 10 or more attempts?

In every business have those kinds of customers and hope we can find solutions to those kinds of customers.

Regards,

I have already reported this last week and still waiting for controller update (as the senior engineer mentioned).

Bug/Vulnerability on EAP225-Outdoor + Omada Controller + Voucher Authentication

They're talking about Controller update. So it's not an EAP firmware update but update on OC200 firmware.

Currently, to avoid free connection, I turn ON first OC200 until it's connected to cloud. It takes about 3 to 4 minutes before OC200 gets connected to cloud. The moment it's connected to cloud, when both LEDs are on steady light mode, that's when I turn ON the EAP. This way, it will only take a few seconds to display the free portal before EAP is synced to OC200.

If you turn them ON at the same time, OC200 and EAP, then your EAP will be  vulnerable for at least 4 minutes before the OC200 portal is displayed.
Also, about the "No authorization", I tried it 2 to 3 times, and the free user got disconnected from the network successfully. 

Due to constant power interuption here, you I can't stop the EAP from powering up  before the OC200. Due to this vulnerability or bug, I'm losing income and been banning clients, So i tried to downgrade the EAP225-Outdoor V1 firmware see screen shot and it worked fine.

I even got the Rouge AP Detection enable which was gone in the current firmware and only has the scan button.

Here is the screen shot from a phone client when I disconnected the OC200 from the network, it has username and password, the new firmware do not have only the term of use and login button only.

Firmware for what?

- OC200? or 
- EAP255-Outdoor?
 

Downgrade to what firmware version?

I guess I'll do the same. As when there's a power loss and I'm not at home, the moment power comes back, a lot of users get a free internet because of this bug.

And how did you downgrade? I don't have the option to select firmware, it only says: Your AP Firmware is up to date.

Hi hashrack,

I just downgrade the firmware of the eap225-outdoor with the oldest one. There are 3 updates i dont know if the 2nd update is also safe. 

I just download it from the tplink site, the firmware version its on my previous screen shot (its the shot that also shows the OC200 version) I appologize for the lack of links but using my mobile phone and current outside the house.

You can download the firmware and there is an option when you click on the accesspoint or click on you eap then click on manual upload of firmware. Remember it takes about 2-10mins before it gets reflected but it will have the username and password before they can login and stop them from login successful.