[jlgaddis]

They mean just what they said: "traffic directed TO the affected system" (emphasis mine).

If you're not used to dealing with routers on a regular basis, that may not make sense.

Then you realize that there's also traffic passing through the system (i.e., being forwarded).

Basically, the key difference is that only UDP packets with a destination IP address belonging to the firewall can trigger the vulnerability. UDP packets with a destination IP address belonging to something else (e.g., a server behind the firewall) that simply pass through the router will not trigger it.

Does that help clarify it a bit?