About this question
I Was setting up Wifi at home today and was appalled at the minimal security that the web server provides.
Default username/password is Googleable and is admin admin
When you do change passwords, your password change is restricted to less than 8 characters and no special characters. No limits on password attempts (Thus brute forcing)
No CSRF tokens
So I thought I would write a simple web-page that port forwards all traffic to the first ip allocated by default and it worked. Does this constitute an exploit? Would most OS firewalls be able to save a victim? Should I buy another router?