I really would like to see more information given in the firewall logging, at the very least a source IP address of where the attack is coming from and the WAN port it is arriving on The current logs...

@bincomIT The cause for me was down to having a portal setup but disabled. Deleted that at TP-links advice and the update has now taken. I think there will be another firmware update in the near...

@supermarkert That's a similar setup to me, two switches, a router and three eaps. Tried what you did and it's exactly the same, downgrade and restore number three happening now, going to leave it...

@supermarkert Interesting, I tried that but not turning the cloud access off. If I have a bored hour this evening I'll have another shot at it. What devices do you have connected ?.

@biomed32uk It's not good is it, the update needs to be revoked while it's semi bricking peoples controllers. There is obviously something in certain configs that is causing the update to fail, as a...

@supermarkert It was from the global site, via the log4j vulnerabilty posting.