Let's say the client's local network looks like this:
10.7.1.46 (client)
10.7.1.158 (unauthorised machine)
Now the client's child can send a request to connect to 0.0.0.0 (local machine), or 10.7.1.158 (local network machine), This is a huge exploitation.