How can attacker know the (victim's) router vendor, for testing default passwords, without physical/visual access to it?
Just by scanning with NMAP tool you can know the vendor and other information of that device. Here, I am scanning a Singaporean router with IP 184.108.40.206 and the results are following,
[arif@arif:~]$ sudo nmap -O 220.127.116.11 Starting Nmap 7.50 ( https://nmap.org ) at 2017-07-06 14:17 +06 Nmap scan report for ae6.singapore2.sin.seabone.net (18.104.22.168) Host is up (0.058s latency). Not shown: 991 closed ports PORT STATE SERVICE 20/tcp filtered ftp-data 21/tcp filtered ftp 22/tcp filtered ssh 23/tcp filtered telnet 111/tcp open rpcbind 179/tcp filtered bgp 514/tcp filtered shell 646/tcp open ldp 3221/tcp filtered xnm-clear-text Device type: router Running: Juniper JUNOS 9.X OS CPE: cpe:/o:juniper:junos:9.2r1.10 OS details: Juniper JUNOS 9.2R1.10 Network Distance: 4 hops OS detection performed. Please report any incorrect results at https://nmap.org/submit/ Nmap done: 1 IP address (1 host up) scanned in 9.49 seconds
If you look at this output closely you can see that in the Device heading it says exactly router and in OS details heading it says not only about it's vendor name (Juniper) but with it's version (JUNOS 9.2R1.10). So most of the time it's pretty easy to guess about OS. I am saying guess because some specific security feature can mislead us about OS.