Would this not also require some sort of exploitable CORS vulnerability?
This is one of the reasons my internal network is not 192.168.1.1/24 and the router is not 192.168.1.1.
Do you also disable WebRTC on all clients on your network? An attacker (or script) may be foiled by your non-standard gateway network, but your work in obfuscating the router is wasted if they can get at your client IP address.
> The attacks work when routers use weak administrative passwords and are vulnerable to CSRF attacks.
Which implies that a cross site request is being made. So e.g. you put a hidden form in a netf1ix.com page whose action is at some URL on the router. The user ends up accidentally posting data to that URL which is not affected by CORS and same-origin.