Verizon and hundreds of other ISPs around the world. I've been working for sometime on firmware development for ISP gateway devices, and most of them implement remote management protocols like TR-069 (http://en.wikipedia.org/wiki/TR-069). They can get all kind of information from your gateway device: from SSID/Key, to SAMBA/FTP passwords, MAC addresses of the devices connected, to it, etc.

If you are worried about your privacy, NEVER use a router you cannot control.