One important followup question is: Which MAC address? The router will most likely have at least one MAC address for the WAN side and one for the LAN side.
Should the vendor have chosen to create usernames with each of the MAC addresses (in the name of usability), that could lead to an interesting vulnerability where changing the default password of one of the users to something more secure would still leave the other username(s) with the default password.
On some routers you will see the LAN and WAN interfaces being assigned adjacent Ethernet addresses. And in case the router has a builtin USB-Ethernet adapter, that one may be adjacent to the other two.
The adversary would only need to know one of those MAC addresses in order to deduce the rest. Additionally from the login page the adversary could likely tell the vendor and firmware version of the router. Those two will be sufficient to deduce the first 3 bytes of the MAC address with high confidence.
There are ways the adversary could learn more information about the MAC addresses:
- One of them will be in the ARP table of devices connected to this router (that includes devices both on the LAN and WAN side of the router).
- One of them will be known to your ISPs DHCP server. And I have seen ISPs embed that MAC address in the hostname used for reverse DNS.
- A traceroute from either side of the router will reveal an IP address of the router, which may have the MAC address embedded in it.
- If a builtin USB to Ethernet adapter is used for a device on the LAN, then that device could potentially leak the information by leaking its own MAC address.
Each of these possible ways the MAC address could leak can be addressed. But I would say there are simply too many ways an adversary could learn a MAC address of your router to safely assume the MAC address can be kept secret.