Re: " that no authentication is used to protect OMA CP "
This seems to be an extension of the carrier inflicted ass-hattery where you got a perfectly good phone and then were sent "carrier settings" to it by text/sms which murdered the performance of the device and removed all the useful stuff that the carrier thought they could charge you for instead.
No excuse for not range checking and treating the entire message and payload as untrustworthy though.
Biting the hand that feeds IT
