FTA: "Last year, researchers at ISE found that a staggering 100% of SOHO routers they evaluated were vulnerable to remote attacks."

However, the linked study[1] shows that:

1. 2 of the routers did not have remote exploits

2. All but 2 of the other routers required authenticated access to exploit remotely

Authenticated attacks "require that the attacker have access to credentials (or that default router credentials are used—an all-too-common situation) or that a victim is logged in with an active session at the time of the attack."

While default passwords may be common, virtually all routers have remote admin turned off by default as well.

[1] https://securityevaluators.com/knowledge/case_studies/router...