Can this be executed from phones (which can act as WiFi router, for tethering purposes) by this ubiquitous baseband RCE vulnerability I always hear about on HN?
Some of these WiFi statistics used in this paper are typically not exposed at the user level. You would need to have a modified driver. May or may not be easy to do for an iOS or Android phone.