Yes, the garbage one seems to come from https requests to an http server.
The HNAP1 requests look like an automated attack against a whole slew of routers.
If it's hitting an Apache install you're fine.
If it's hitting any sort of cable/DSL router it's quite possibly hosed. You should reset it and update the firmware to the latest version. The exploit could allow a hacker into your inner network, but I really doubt the automated attack goes that far. Fortunately, it would seem that it can only change the password and settings, so a reset will undo it, though it will just happen again if you don't update to a fixed firmware. More permanent exploits that involve overwriting the firmware would be device-specific.