You haven't logged into your router since you plugged it in, and that's exactly what attackers want ...