TCP connection termination via forged NAT remapping

TCP session hijacking in D-Link DI-7003GV2 routers allows attackers to terminate active connections by sending forged packets. The router preserves NAT source ports, lacks strict reverse-path validation, and accepts forged resets because TCP window tracking is disabled, so its NAT mapping can be evicted and rebuilt for the attacker. An attacker must join the same network as the victim, identify a live TCP flow, and win a timing window before legitimate traffic refreshes the mapping; success interrupts that connection without crashing or rebooting the router.