Yeah, DNS rebinding attacks can allow malicious Javascript running inside the network attack the router from the LAN side.