There are many ways, even if WAN-side Management is disabled, to take over these routers from the WAN side. E.g. [1, 2] There are also vulnerabilities in the auto-provisioning protocols used by the modems that can give the attacker an entry-point. [3]

This is just the tip of the iceberg from 10 minutes of Googling. I also recall there was some technique where an attacker could reflect attack traffic through a browser and back into the router, so if you knew the router IP and user/pass you could compromise it by getting the user to visit a malicious or drive-by-hacked site.... but I couldn't find a link for that one.

[1] - https://securityevaluators.com/knowledge/case_studies/router...

[2] - https://www.eff.org/deeplinks/2014/08/def-con-router-hacking...

[3] - http://www.computerworld.com/article/2491042/malware-vulnera...