I found out by chance while working with a client's TP-Link ADSL gateway that non-admin users are able to telnet to the TP & execute a script to .