Unless you also disable execution of Javascript on all the devices that connect to your network (including your phones, set-top boxes, etc.), these devices can

Unless you also disable execution of Javascript on all the devices that connect to your network (including your phones, set-top boxes, etc.), these devices can be used to attack your router from the LAN. Just use Javascript to autosubmit a form with action="http://192.168.1.1/exploitable/endpoint/" http://192.168.1.1/exploitable/endpoint/" (you can autodetect the IP, look for Javascript port scanners on Google) and you're in. And before you say that DD-WRT is not $WEIRD_CHINESE_BRAND and obviously doesn't have such vulnerabilities on its HTTP interface that can be accessed without auth, see https://www.cvedetails.com/vulnerability-list/vendor_id-9341/product_id-16564/Dd-wrt-Dd-wrt.html https://www.cvedetails.com/vulnerability-list/vendor_id-9341... for some real examples, including "getting root by sending an HTTP query that doesn't require any authentication". In fact, for that remote root exploit, disabling Javascript execution wouldn't even help that much, because it can be triggered through e.g. <img src="..."/> on any HTML page you visit (with some guessing required for the IP address, but there are only so many IPs people commonly use for their gateway).