The AD Helper component in WatchGuard Fireware prior to 5.8.5.10317 allows remote malicious users to discover cleartext passwords via the /domains/list URI.
watchguard ad helper firmware