If you do not do any filtering on inbound connections from HQ to any device on routers/firewalls that reside on the HQ subnet(s), and you do not turn on the stateful firewall that is integrated on the cisco vpn client, then it is possible for someone at HQ to connect to the vpn client, using the vpn ip address. I believe that the cisco vpn client version 4.x does enable file and print sharing for the virtual adapter for ms win clients by default, so at a minimum the admin shares are accessable. Again, this only pertains if there is no filtering/blocking of connections destined to the vpn client subnet space.
Let me know if this is of any help.
