Web server itself could be an attack vector too. Although not specified to TP-Link, There are many exploits on other brands that can bypass the Authentication.

Web server itself could be an attack vector too. Although not specified to TP-Link, There are many exploits on other brands that can bypass the Authentication. For example this one: https://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-routers-with-cve-2021-20090-and-rooting-some-buffalo-ea1dd30980c2 https://medium.com/tenable-techblog/bypassing-authentication... Even allowing access the web server from internet could be dangerous.