In 2002, Zhu et al. proposed a password-based authenticated key exchange protocol based on RSA. Zhu et al. claimed the protocol is efficient for the low-power devices in wireless networks. Unfortunately, Yeh et al. pointed out that Zhu et al.'s protocol was weak against undetectable on-line password guessing attack. Not only that, Zhu et al.'s protocol does not achieve explicit key authentication. At the same time, Yeh et al. proposed an improved method. However, in this paper, we shall point out that Yeh et al.'s improvement is vulnerable to the off-line password guessing attack. At the same time, we shall propose a solution to resist the above attack.