Telltale sign your router is now part of a botnet:
Management interface still accessible from internet when remote management is disabled.
You ran out of file descriptor. Either too many open file or socket. I suspect it's the latter since that's what botnet mostly do.

Unless you have the firmware, which you don't because no ISP publish firmware for their rubbish...

Scrap this device and buy a new one.

EDIT:
You test and open the web UI from another telco like mobile data right?

This post has been edited by kwss: Aug 19 2025, 09:08 PM

Then I can say with certainty your router is a bot.
You need to keep your router firmware updated.
Disable all remote management.
Change all default password.

The thing with TM router is that even if you disable TR069, VLAN 209 is still terminated in both the ONU and the router. So technically your device is still discoverable remotely.

To make matter worst, the TM firmware will allow ACS unrestricted access, meaning it's possible for VLAN 209 to jump into your LAN.

I want to be very clear: No amount of firmware update will help if you are using TM hardware.

The boa web server is forever vulnerable. The ACS and VLAN209 is forever there.

Most importantly, their new firmware don't fix security issue or what not. They only fix compatibility issue.

If security is a concern, do not plug in anything from TM into your network.