Tim:
Picture this scenario: You plug in your new wireless router, it has no security settings. You configure it using the HTTP webserver, and your passwords (any you set into it) are part of the HTML source code, viewable by anyone else at the same time. Your browser may display them as ***** in the webform, but it's only the browser display that's obscuring them.
max:
You can make the router only accessible via https, at least I can on my Linksys though I am not sure if that would fix the issue in question.
Mine doesn't appear to listen on anything other than port 80. I settled for turning off wireless, then configuring things, then turning it back on using WPA2 only.
There is some OPen WRT firmware for the linksys that I have been dying to try though........
I had a look on the site for that, mine's only "partially supported".