An issue exists on ASUS RT-AC1900P routers prior to 3.0.0.4.385_20253. They allow XSS via spoofed Release Notes on the Firmware Upgrade page.
asus rt-ac1900p_firmware