Ask HN: My ISP notified me my router was hacked, what do I do?

HN, my ISP notified me that my router was hacked and was used to attack other computers.

I was told to simply disable UPnP and block port 1900. That's simple enough and I suppose I should reset and upgrade the firmware first. I don't know much about UPnP vulnerabilities. Is it possible that the computers connected to my wifi were compromised?