[spraak]

Does someone need to have control of the router to do this? Or how could it work otherwise?

[cakebrewery]

It's in the article. He spoofs the MAC address to trick the gateway into thinking the attacker is the victim.