I tried to figure out how to do this a while ago. Doesn't anti cross site scripting built into most modern browsers stop this? The flash and java security models certainly do.

I think you can do this by serving the user a hidden form that e.g. sends a firmware to the device, and a real form that they are likely to submit. The hidden form is the one that actually gets submitted. But I thought anything via XHR wouldn't work. Which is needed for a brute force attack say.

What did you find?