Return to Answer

Attackers would need non-commodity hardware such as a HackRF; i.e. an ordinary Wi-Fi device is not enough. They can:

Finally, although an unpatched client can still connect to a patched AP, and vice versa, both the client and AP must be patched to defend against all attacks! ... it might be that your router does not require security updates. We strongly advise you to contact your vendor for more details ... For ordinary home users, your priority should be updating clients such as laptops and smartphones.

both the client and AP must be patched to defend against all attacks [...] it might be that your router does not require security updates. We strongly advise you to contact your vendor for more details [...] For ordinary home users, your priority should be updating clients such as laptops and smartphones.

implementations can be patched in a backwards-compatible manner [...] To prevent the attack, users must update affected products as soon as security updates become available. [...] a patched client can still communicate with an unpatched access point, and vice versa.

There is a fix for both APs and clients, it doesn't matter which one you patch first.

implementations can be patched in a backwards-compatible manner [...] To prevent the attack, users must update affected products as soon as security updates become available. [...] a patched client can still communicate with an unpatched access point, and vice versa.

However, both client and router must be patched (or confirmed secure):

Finally, although an unpatched client can still connect to a patched AP, and vice versa, both the client and AP must be patched to defend against all attacks! ... it might be that your router does not require security updates. We strongly advise you to contact your vendor for more details ... For ordinary home users, your priority should be updating clients such as laptops and smartphones.