[kelnos]

> Step 2 forces the default password to be changed. There is no way around that step.

Sure, and you can change that password to "foobar" or whatever bad password you want. And I bet that login page doesn't have any rate limiting or a lockout after too many failed logins.

Fortunately, though, I don't think there are any of these that enable remote admin by default, so the owner would need to do that explicitly. Hopefully they've paired that with a strong password. Even then, I still wouldn't advise anyone actually doing this...

(Your manual link is broken; it takes me to a page that just links to TP-Links main marketing website.)