Yes and no. You can downgrade with the current exploit without the red card, but you can't install .cia unless you either have the red card or someone confirms CFW working on a downgraded console (and, as far as I can tell, the only current CFWs require the red card to install, anyway).
No the cfw recquire only a ds flashcart.