Judging by the CVE they linked, you need local access. But, since it's a GET parameter, this could be a drive by attack where someone puts all the links to common home networks in a page and the browser just takes care of that (and there are ways to guess the local network). Though, judging by the number of people affected, it might be something else.