My Belkin router spews both of its MAC addresses onto the screen to anybody who hits the admin website, before authentication.

Getting to my router with an attack is a little less trivial since it is no longer on 192.168.1.1. Also I'm not sure if there's an XSS attack that an unauthenticated user can fire, as any attempt to do anything is just giving me a login box which itself doesn't have an XSS. But this is my 90 second security analysis, if I tried harder I'm sure there's something nasty somewhere.

Or anyone who is authenticated and cookied.

Does anyone stay logged into their router when they're not using it? And don't most sessions expire fairly quickly, anyways?

Besides that, this appears to only work with wireless routers, based on how google is locating them.

No, he uses an example XSS exploit to view Verizon FIOS router pages, but there are lots of ways to get MAC addresses.