A hacked/compromised router is the worst thing that can happen to computer users [computerworld.com].
Any computing device (smartphone, tablet, laptop, desktop, refrigerator) sitting behind a compromised router can be attacked in every known way.
Needless to say, a router can be used for spying, not just on normally insecure communications but its also a perfect host for man-in-the-middle attacks on supposedly secure communication (SSL/TLS/HTTPS).
Compromised routers can send victims to scam versions of websites, a great way to collect passwords. In August, Jeff Atwood wrote about two people whose routers were hacked. One router modified web pages to show extra ads, another tricked a victim into installing a hacked version of the Chrome browser. And, of course, a router can be used to install malware on computers too. Did your last Flash update really come from Adobe? How would you know?