Although this is not within the scope of our research, from what we have gathered, it appears that this vulnerability can be triggered through the Cloud interface (ie without direct connection to the device).
This further emphasizes the need for the steps mentioned above, as the Wemo Cloud infrastructure can be used as a potential attack vector.