Installation without opening the case (Web Interface Hack)
SSID Config Injection
Newer versions of TP-Link firmwares do besides encryption furthermore compression of config files. Without knowledge of the compression algorithm it's not that easy to inject shell commands (like in the old StatPost approach). But there is a much easier approach. It seems the whole config gets executed / evaluated through ash somehow. Therefor you can inject commands anywhere in this config file or it attirbutes. To get shell access we use the SSID of wifi:

Login to the router web ui at 192.168.1.1. T
Set Wifi (2.4 or 5GHz) SSID to `telnetd -p 1023 -l login`
telnet 192.168.1.1 1023 (User: admin Password: 1234)
StatPost (old)
Steps to access the linux shell using telnet for the TD-W8970 v1 firmware version0.6.0 2.12 v000c.0 Build 140613 Rel.31066n. Without opening the router physically.

Login to the router web ui at 192.168.1.1. Take backup of the router configuration conf.bin(Keep one copy safely incase you screw up things!)
download tplink configuration encrypter/decrypter tool from the link below. http://ejs1920.users.sourceforge.net/StatPOSTer-20160306.jar (Thanks ejs1920 for making this tool)
Launch the program StatPOSTer-20160306.jar
Select the router as TD-w8970v1 and click on decrypt button in the program and select the config file you saved in the step1
Save the decrypted conf.xml
Open the the decrypted conf.xml in notepad(would suggest to keep backup of this file just in case)
Add the xml tag <Description val="TD-W8970 v1`telnetd -p 1023 -l login`" /> after the xml node SerialNumber and save it.
Click the encrypt button, select the modified config, save as conf_modified.bin
Login to the router web ui at 192.168.1.1 and upload the new conf_modified.bin. And let the router reboot.
Router will reboot and have TD-W8970 v1`telnetd -p 1023 -l login` at the top, this is expected.
Telnet to (using putty or something like it) 192.168.1.1 at port 1023
Enter the user name as admin and password as 1234 (Looks like some sort of backdoor, there goes my peace of mind!)
You are ready to go and have access to linux shell.
How does it work: probably by injecting the script telnetd -p 1023 -l login

Note:Below steps have not been tried by me, but are likely to work for this device(Please don't forget to use the right version of the OpenWrt firmware to the right path while flashing, I don't know the right version, you need to figure it out yourself.)

Try to use the method in the link https://wiki.openwrt.org/toh/tp-link/td-w9980 to update the firmware without opening the device at section "Web Interface Hack (Install OpenWrt without opening the case)".