Shodan returns some 5100 Tomato servers, with about 1500 running web services (presumably the remote administration). I would bet that a fair number of those 1500 servers (maybe 10%?) have the default password, but I'm not going to check.