@babasse29 Have you found a solution for your problem? On my new VR600v I also disabled the remote access, but i am still able to login from the internet.

@Hadde 

No i completely uninstall this router, too much bugs

I opened a support ticket for some others problem (for exemple vdsl2 doesnt work or config reset without reasons), but i got

120 euro (base Price 150 euro), is too expensive for such low quality.

First and last Time i buy  tp link thing.

@Kevin_Z 

I have just discovered this thread about the modem/router being able to access the Web management GUI console via the public ip address that is assigned by the ISP. On the left side of this screenshot is browsing to the public ip address assigned by the ISP; able to login with the admin password that I assigned and configured to router. On the right is accessing via the local LAN to the web GUI of the VR 900.

Note - I do not make use of the TP-Link cloud account..

Even though remote management is disabled. See screenshot below

Please can you or your technical team help explain this, to all the posters on this thread.

From what I understand, I am able to access the public IP address that is assigned to this router, from the ISP, with no restrictions, with no security certificate, if you type in the password  and submit the password, the password is not sent encrypted, as there is no https security configured currently on the site(the password will be sent in plaintext over the Internet) , despite the modem router is not enabled for "remote management".

As it stands the only thing preventing anything malicous accessing the router is the admin password for the router and knowing the public IP address. Also I have not yet tested on clicking on the link "forgotten password", I guess that would reset the router completely...

@babasse29  

Since you have given up with TP-Link, what router did you finally decide to use over the TP-Link? Currently I am considering replacing the existing TP-Link with either Draytek, ZyXEL, ASUS, Billion, D-Link model.

From previous posts, there seems to be a discussion here

https://community.tp-link.com/en/home/forum/topic/178096

that describes that this is default behaviour of the modem/router.

@4x3.2x9 

I suggest you do some reading up first, Draytek maybe but all the others you mention go for it if you like a headache of problems and patches constantly

Google Router Security.Org

Everything you need to know is there.

Ok, will check that out, thanks!

@4x3.2x9 

Whoops I spoke too soon,

https://www.zdnet.com/article/a-mysterious-hacker-group-is-eavesdropping-on-corporate-ftp-and-email-traffic/