Danger of default router password

How bad is it to not change the default home router password? Are there any concrete dangers?

Are there any attacks directly resulting out of the use of default passwords, not vulnerabilities in the firmware?[*]

You can assume that anyone legitimately connected to the router is allowed to access and change it's configuration [**].

_{[*] I found this vulnerability, but it seems to be a vulnerability in the router firmware (which could be prevented using anti-csrf tokens), not a direct result of using a default password.}

_{[**] So I'm not worried about other residents or visitors that are allowed access to the network.}