An unauthenticated attacker can obtain a serial number of a smart meter(s) using its owner's username.
CWE-639