Advantech/BroadWin WebAccess 7.0 and earlier allows remote attackers to obtain sensitive information via a direct request to a URL.  NOTE: the vendor reportedly "does not consider it to be a security risk."