Correct me if I'm wrong, but in order to perform this attack you need to be connected to the router's LAN in order to access the admin page, right? So you would need to gain access to the WiFi or attach a computer to the router via Ethernet. This cannot be exploited over the internet, unless perhaps the user enables the admin page via WAN.