I can also confirm this bug on a TP-Link Archer C9. The Username and Passwords to the router have definitely been changed, yet Avast reports that they are the default admin and admin. If I lock the router out (No router logins allowed for 2 hours) by trying to log in to the router with invalid credentials 10 times, then running Wi-Fi Inspector, Avast still reports 'Weak or default password found'.