I may be reading it wrong, but I think you have to be on the same network as the victim. Still, you're right this is very serious.
> However, much more interestingly, we see that the implementation for [vendor-specific] command #4 seems relevant to our current pursuit. First, it does not require the existence of a TDLS connection in order to be processed!