Separation or anti-sniffing of admin gui from target open SSID?

[Morthawt]

Is there any isolation between clients who connect to the target open SSID vs management SSID? I connect my phone to the target open SSID and I can still get to the internal web gui. Which made me think, since there is no ssl/tls on the login, could a "target" connected to the open SSID run a sniffer and sniff my credentials when I login on the web GUI to check the status of things?