In Plaintext COUNTER CHECK message accepted before AS security activation, there is a possible missing permission check. This could lead to remote information disclosure no additional execution privileges needed
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor