Also this --> Security researcher Vinoth Kumar told Reuters that, last year, he alerted the company that anyone could access SolarWinds’ update server by using the password “solarwinds123”
https://www.reuters.com/article/global-cyber-solarwinds/hack...