Why does running LTE on commodity hardware and software create a general security threat?

LTE infrastructure runs on commodity hardware and software — "with great commodity comes great responsibility" — so it inherits the software and hardware flaws pervasive in any general-purpose operating system or application.

The threat:

• Modern LTE base stations and core elements are increasingly built on general-purpose hardware and operating systems (think Linux servers, standard CPUs), not bespoke telecom hardware
• That commoditization brings cost and flexibility benefits — but also inherits every vulnerability of those general-purpose systems (unpatched CVEs, misconfigurations, OS bugs)
• The NIST analysis illustrates this with the National Vulnerability Database (NVD) — the same vulnerability ecosystem that affects general IT also affects telecom

The mitigation:

• Security engineering and a secure system development lifecycle (SDLC) — i.e., treat telecom infrastructure with the same disciplined security practices as any other critical software

The big-picture lesson (this whole topic is from a NIST analysis, "LTE Security – How Good Is It?"): as networks become software, telecom security and general IT security converge. The threat model of a 4G core now includes ordinary server compromise, not just radio attacks.

Go deeper:

• NIST SP 800-187 — Guide to LTE Security (2017) — the authoritative NIST publication this entire threat catalogue is built on: LTE architecture, security mechanisms, and each threat with mitigations.