A hardware firewall can be penetrated by a javascript embedded in a webpage.
Samy Kamkar has demonstrated a way on how to do it. “What this means is I can penetrate their firewall/router and connect to the port that I specified, even though the firewall should never forward that port. This defeats that security by visiting a simple web page. No authentication, XSS, user input, etc. is required,” Kamkar told The Register.
The visitor must have a program like a session initiation protocol for this exploit to happen.
Source: The Register
