You don't need any fancy rebinding attacks. That's a bit 2001 era web hacking :)

This issue is based on WebSockets where the software on the modem:

a) Doesn't verify any of the origin headers sent, so any origin works (rebinding is designed to beat origin checks)

b) Copies an uploaded message straight onto the stack without doing any size checks