Unless you also disable execution of Javascript on all the devices that connect to your network (including your phones, set-top boxes, etc.), these devices can be used to attack your router from the LAN. Just use Javascript to autosubmit a form with action=&quot;<a href="http:&#x2F;&#x2F;192.168.1.1&#x2F;exploitable&#x2F;endpoint&#x2F;&quot;" rel="nofollow">http:&#x2F;&#x2F;192.168.1.1&#x2F;exploitable&#x2F;endpoint&#x2F;&quot;</a> (you can autodetect the IP, look for Javascript port scanners on Google) and you&#x27;re in.<p>And before you say that DD-WRT is not $WEIRD_CHINESE_BRAND and obviously doesn&#x27;t have such vulnerabilities on its HTTP interface that can be accessed without auth, see <a href="https:&#x2F;&#x2F;www.cvedetails.com&#x2F;vulnerability-list&#x2F;vendor_id-9341&#x2F;product_id-16564&#x2F;Dd-wrt-Dd-wrt.html" rel="nofollow">https:&#x2F;&#x2F;www.cvedetails.com&#x2F;vulnerability-list&#x2F;vendor_id-9341...</a> for some real examples, including &quot;getting root by sending an HTTP query that doesn&#x27;t require any authentication&quot;.<p>In fact, for that remote root exploit, disabling Javascript execution wouldn&#x27;t even help that much, because it can be triggered through e.g. &lt;img src=&quot;...&quot;&#x2F;&gt; on any HTML page you visit (with some guessing required for the IP address, but there are only so many IPs people commonly use for their gateway).