A CSRF attack like those in the post don't even require JavaScript or even a code snippet. All you would need to do is include an img
tag like this:
<img src="http://192.168.0.1/?somethingbad">
See:
http://192.168.0.1/?somethingbad
Open your network panel and refresh the page and you will see the request (unless you're using NoScript's ABE feature, or some other browser firewall like uBlock Origin).
I'm afraid there's not much that can actually be done to protect users with such vulnerable routers.