I'm the sole person who has access to this router. I turned uPnP off and have twice found it turned back on in recent weeks. The Router is Asus DSL-AC68U.
I have a VPN running at the router level, installed about a month ago. I've recently updated the firmware on it too but after extensive searching neither of those should have affected it. The only thing I've come across is that there must be malware inside the network.
Can someone please advise?
Buggy firmware.
There's an old saying in IT:
Never attribute to malice what can be sufficiently explained by incompetence.
This can be fully explained by a buggy firmware that somehow re-enables it automatically after reboot, or never disables it in the first place, or resets that part of the configuration due to some other random event.
Consumer router/AP firmware is well known for being old version, riddled with bugs. The selling points of these devices is not security, it's whatever superlatives about speed they can stick on the box it comes with. The firmware and lack of security is only evident after you've bought it.
The only thing I've come across is that there must be malware inside the network.
The attack (if any) could come from outside your network.
This could be the result of a CSRF or DNS rebinding attack on your router configuration UI. This assumes that your router is vulnerable to either of them.
This could be the result of a reflected XSS as well.
Note that these would be problems in your router firmware. Not something you can configure.
See this list known vulnerabilities in your device. These have probably been patched in your version since you claim you have recently updates the firmware. We can see that the device have been found to be vulnerable to several XSS and XSRF vulnerabilities in the past.
