Comment by varenc

This tag:

    <img src="http://192.168.1.1/router?reboot=1">

triggers a local network GET request without any CORS involvement.