Here's more context about what the password was for. https://twitter.com/vinodsparrow/status/1338431183588188160 https://twitter.com/vinodsparrow/status/133843

Here's more context about what the password was for. https://twitter.com/vinodsparrow/status/1338431183588188160 https://twitter.com/vinodsparrow/status/1338431183588188160 This tweet has a screenshot of an email from Vinoth Kumar (named in the CNN article) to SolarWinds saying: Hi Team, I have found a public Github repo which is leaking ftp credential belongs to SolarWinds. Repo URL: https://github.com/ Downloads Url: http://downloads.solarwinds.com FTP Url: ftp://solarwinds.upload.akamai.com Username: Password: POC: http://downloads.solarwinds.com/test.txt I was able to upload a test POC. Via this any hacker could upload malicious exe and update it with release SolarWinds product. (The tweet blanks out some things including part of the github URL, the username, and the password.) My thoughts: (1) I assume this means when it comes to technical measures to prevent a weak password, SolarWinds would have to rely on Akamai. (2) The researcher was able to upload to the root directory of downloads.solarwinds.com. As an educated guess, this may have been a shared account and many people knew this password. When many people share an account, they tend to choose passwords that are easy to convey to someone else. If so, the intern probably didn't create the password and was only responsible for leaking it.