Sadly, wrong. Assuming 192.168.1.1 is your router, you can craft a webpage on the public internet to exploit that IP address, without javascript. With js, it'

Sadly, wrong. Assuming 192.168.1.1 is your router, you can craft a webpage on the public internet to exploit that IP address, without javascript. With js, it's trivial.. But you have to deal with CORS being set up. Question then becomes - is CORS set up right? If not, pwn3d.