TCP session interruption via forged NAT remapping

TCP session hijacking in Wavlink QUANTUM D2G routers allows remote attackers on the same Wi-Fi network to interrupt active connections. The router preserves NAT ports, accepts spoofed reverse-path traffic, and disables TCP window tracking, so forged RST packets evict a victim's NAT mapping and expose valid sequence numbers through a replacement mapping. Access to the victim's Wi-Fi network and knowledge of the router's external address are required; a forged RST can then terminate the targeted TCP connection without crashing or rebooting the router.