By default, my AT&T home router doesn't ask for credentials until I ask to change something. Our office router is completely authenticated with HTTP Basic. Different routers, different results, but there are an awful lot of routers that assume that if you can hit the router's internal address, it must be safe for you to get information about the router.
What kind of bigger problems?
Typically this means there's either a serious XSS flaw or a default password on your router. Someone could, for example, change your DNS settings and start intercepting your traffic.
One word... JavaScript
In Java, getHardwareAddress() returns your MAC.
If your browser runs Java code without a warning you have a lot more problems than someone knowing your MAC... Also that would still not be your router's MAC.