An authenticated user can view other users' login information and possibly gain access to passwords. The configuration file dialsrv.ini, which contains user login information including encrypted passwords, is accessible to all Windows authenticated users. The weak encryption scheme used by SmartServer3 can be easily broken using a third-party utility.