Network impersonation via skipped LTE authentication

Improper authentication in Qualcomm Multi-Mode Call Processor firmware allows remote attackers to impersonate an LTE network during attachment. The LTE attach flow accepts a Security Mode Command from a rogue base station before completing network authentication, bypassing the expected authentication phase. Exploitation requires radio proximity and rogue base-station capability and permits confidentiality and integrity compromise without service interruption.