Whether TWC is responsible, or SMC — the people who make the router — this pretty much covers everything wrong you can do regarding securing a router:
Chen[…]said he was trying to help a friend change the settings on his cable modem and discovered that Time Warner had hidden administrative functions from its customers with Javascript code. By simply disabling Javascript in his browser, he was able to see those functions, which included a tool to dump the router’s configuration file. That file, it turned out, included the administrative login and password in cleartext.
Chen investigated and found the same login and password could access the admin panels for every router in the SMC8014 series on Time Warner’s network — a grave vulnerability, given that the routers also expose their web interfaces to the public-facing internet.
