Why does having default router credentials pose a risk?
Default credentials mean that anyone knows them and can use them to gain access to the device. This is bad enough, let alone if they provide admin level access.
Assuming you meant a home DSL wireless router, a router is usually a device that combines a switch (can jack in a couple of computers, usually 4), DSL gateway (connects to the ISP through your phone line), WLAN (WiFi network) and some other, optional, functionalities (DNS resolution, DHCP server, firewall etc).
As such, here are a couple of things that an attacker could do with admin access to your router:
- she could configure your DNS server - this may result in her being able to steal credentials by setting up fake sites and fooling you into thinking that they are legit
- she may be able to whitelist a MAC address to your WiFi (if you have MAC filtering enabled) and, along with the WiFi password that she can probably see, allow herself into your wireless network
- she may setup dynamic dns so that there's no need to discover your IP everytime she wants to connect to your network from a distance
Can an attacker exploit this even while not connected to my network?
Usually the credentials are only useful if they can be used on the device which they refer to, which also implies access to the device. However there are cases where direct access to the device is not required (see ysdx's answer)
Does this only pose a risk if an attacker knows my wifi password first?
No. An attacker may first gain access to any other device in your home network (e.g. your personal computer) and then access the router