QUOTE
If you haven't changed the default password on your home router, do so now. That's what researchers at Symantec and Indiana University are saying, after publishing the results of tests that show how attackers could take over your home router using malicious JavaScript code...Once the router has been compromised, victims can be redirected to fraudulent Web sites...Instead of online banking, they could be giving up sensitive information to phishers...At the heart of the problem is the fact that consumer routers ship with simple, well-known default passwords, like "admin," which could be exploited by attackers...

infoworld.com