Recently, Chang et al. proposed a security enhancement in Ku and Wang's authenticated key agreement protocol. Two parties employ the pre-shared password to agreement a common session key via insecure network. However, in this article, we will show that Chang et al.'s scheme is suffer from the backward replay attack and the off-line password guessing attack.