A vulnerability in Microsoft ActiveSync 4.x -1 been found that allows an attacker to discover the device password of a Windows Mobile smartphone. Normally you can lock your Windows Mobile phone by setting a password. Even if someone uses ActiveSync to connect to your phone they still need to enter the password before they get access to your email and private data.
The vulnerability is in the method ActiveSync uses to encrypt the password it sends to the phone. The attacker can sniff the USB cable network connection and capture the password. Due to the way the password is encrypted the decryption key is effectively included multiple times, one copy of the key for every character. Once the attacker -1 the decryption key, they’ve also got your password.
Fortunately, while this is an interesting vulnerability it’s not likely to be heavily exploited. There are a few obstacles in the attacker’s way.
Computer Security Research - McAfee Avert Labs Blog