[photon]

That sounds about right from what I understand of the nature of the attack. The attack forces the client to reload a key, which has a side effect of resetting a counter that is used as part of the initialization of the encryption stream. Since the counter is reset to zero, how the encrypted stream is constructed can be predicted so the information can be decrypted.

Because the attack focuses on the behaviour of the implementation of the protocol on the client, routers themselves aren't vulnerable per se.

That said, I think a router could be patched to alter the behaviour if he conditions leading up to an attack are detected and behave differently so that a client that has been attacked isn't allowed to setup a successful encrypted stream.