In February 2000, someone posted a tool to SecurityFocus's Bugtraq forum that writes to the SNMP variable used to start downloading a Cisco or Ascend router's configuration to an arbitrary TFTP server. A second command could be used to reload the configuration from the same server, along with any changes. Defense against SNMP includes using access control lists to limit access to the SNMP agent to specific IP source addresses. At the very least, change your community strings, block access to UDP port 161, and use whatever mechanisms your router vendor supports to protect against SNMP abuse. Or, better yet, disable SNMP if you are not using it.
Some attacks can overwhelm a router.
For instance, if someone within your network launches mstream, a DoS tool used to flood a target network, it can also fill caches used in some router configurations to speed routing decisions. Mstream spoofs source addresses, and the cache treats each source and destination address pair as a cache entry, so the cache can quickly be filled with garbage entries. Sometimes, a router can be used to mitigate a DoS attack, through mechanisms like traffic shaping or custom queueing. But the DoS flood may prevent access over the network to the very router you need to configure to block the attack. Modems are easily discovered by war-dialers, so if you choose to use a modem on a console port, use a pair of encrypting modems or some other method of protecting access.