Unwanted device in the router list

Recently I found an unwanted mobile device connected to my TP-link router; I didn't allow access or give any password to it.

The default Wi-Fi password was already changed and didn't activate WPS. The security is set to WPA3-Personal+WPA2-PSK[AES]. Guest and IoT network aren't activated either.

I don't know how a cell phone got the ability to use my router without being provided with a password!

The arp -a command result isn't exactly comprehensible to me, and also found other user(s) reported here, so I think that this command doesn't necessarily list ALL the connected devices.

How do I stop this and through CMD find if there are other unauthorized devices also using my network without my permission (which I will never give).

CMD is not magic. The screens and information on the router's control panels will be populated using the equivalent of the command you could run in the command prompt on your computer, but with the benefit of running at an elevated access level on the router controlling the network.

So, you've already done the right things. How that device got on we cannot say. Keep your router firmware updated and check for new devices occasionally as you wish, and you'll be as safe as you can be.