I have a Denon receiver with a web interface, which can control everything over HTTP (volume, source selection, firmware, etc). Of course there&#x27;s no CSRF protection, so anyone could just control my receiver by getting me to visit a page that tried POSTing to 192.168.0.XXX – it would be trivial.