Suppose you visited a website serving malicious JS (through an ad, for example). This malicious JS sends a large POST request to your router, crashing it and forcing it to restart. This knocks you offline for about 5 minutes while the router restarts, constituting a short-term denial of service attack. Would you think this is rewardable under a bug bounty program?
The issue is with one of the current rental modem+routers from a major US ISP, so there are likely millions of devices vulnerable. I'm still trying to find if it's a buffer overflow or just memory exhaustion, but I suspect the la…