If you are still using the default username+password on your router. This article should persuade you

I still wonder why people don't change the default password

The DNS settings of a router can be overwritten thanks to the JavaScript code containing more than 1,400 login combinations, including a list of common passwords.

DNS changes can only be made if the victim accesses a compromised website on their mobile device

To prevent hackers from gaining control of their routers, all consumers need to do is to keep their home networking router’s firmware up to date, and to avoid using the default ID and password provided with the device when it shipped

For more info:
http://www.digitaltrends.com/web/javascript-malware-mobile/