You don't even need xss for this. You can simply bruteforce the password and try to get some fingerprint of the router and enable remote management. I did this

You don't even need xss for this. You can simply bruteforce the password and try to get some fingerprint of the router and enable remote management. I did this some years back. Back then I also needed to find out the routers IP. Did this via iframes and the js onload event.