NIGHTSTAND: NSA Exploit of the Day

Today's device from the NSA's Tailored Access Operations (TAO) group implant catalog:

NIGHTSTAND (TS//SI//REL) An active 802.11 wireless exploitation and injection tool for payload /exploit delivery into otherwise denied target space. NIGHTSTAND is typically used in operations where wired access to the target is not possible.
(TS//SI//REL) NIGHTSTAND - Close Access Operations • Battlefield Tested • Windows Exploitation • Standalone System
System Details

• (U//FOUO) Standalone tool currently running on an x86 laptop loaded with Linux Fedora Core 3.
• (TS//SI//REL) Exploitable Targets include Win2k, WinXP, WinXPSP1, WINXPSP2 running Internet Explorer versions 5.0-6.0.
• (TS//SI//REL) NS packet injection can target one client or multiple targets on a wireless network.
• (TS//SI//REL) Attack is undetectable by the user.

(TS//SI//REL) Use of external amplifiers and antennas in both experimental and operational scenarios have resulted in successful NIGHTSTAND attacks from as far away as eight miles under ideal environmental conditions.
Unit Cost: Varies from platform to platform
Status: Product has been deployed in the field. Upgrades to the system continue to be developed.

Page, with graphics, is here. General information about TAO and the catalog is here.
Presumably, the NSA can use this "injection tool" in all the same ways it uses QUANTUM. For example, it can redirect users to FOXACID servers in order to attack their computers.
In the comments, feel free to discuss how the exploit works, how we might detect it, how it has probably been improved since the catalog entry in 2008, and so on.