The LANHostConfigManagement profile in the IGD profile has a few interesting methods, primarily SetDNSServer. With this method it should be possible to set DNS servers on the router and reroute a lot of interesting sites (read: banks) to an attacker's server. If you are scared right now: so far I have not encountered an IGD stack that implements this method. Luckily.