Apologies, I understand where the flaw lies now. I thought you meant the XRSF was triggered from within the DD-WRT interface. I don't know how much of an impact this will really have though, I suppose it would depend on how long login sessions last on DD-WRT and how often the user logs into their router. Still, good find!
