[amluto]

Some CPE exposes an API on the LAN side, and some of these APIs aren’t protected against CSRF. I wonder whether the modem in question is vulnerable.

[mh-]

Browser security enhancements have made enumerating those a lot more difficult, but a quick google suggests there were still tricks to achieve DNS rebinding as recently as 2023. Very possible.

[amluto]

I can probably guess a cable modem’s IP address and a crappy CPE router’s IP address in one guess each. Enumeration isn’t usually the problem.