The UK has found many, and documented outline details of them in annual public reports, like [1] In outline: - Version management issues, with different firmw

The UK has found many, and documented outline details of them in annual public reports, like [1] In outline: - Version management issues, with different firmwares being used for each operator, with significant variations in each one [1]. - Failures to follow Huawei's own secure coding guidance, and sustained examples of poor coding (examples of which include tricks of the form of: #define SAFE_LIBRARY_memcpy(dest, destMax, src, count)memcpy(dest, src, count) to make code appear to no longer use unsafe functions, and make auditing harder. [2] - When critical vulnerabilities were found (arising from poor code quality in user-facing protocols, and an old operating system), they were fixed, but the fix introduced another major issue into the product in question. [1] - Reliance on out-of-support RTOS in products, and no alignment of own product lifespans to external support lifespans, and no identification of this issue by themselves. [1] - Previously, 70 full copies of 4 different OpenSSL versions were found in products (and 304 partial copies), some of which dated back to 2006 with multiple disclosed vulnerabilities in each, showing no dependency management at all, and no management of vulnerabilities in dependencies. [2] [1] https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/923309/Huawei_Cyber_Security_Evaluation_Centre__HCSEC__Oversight_Board-_annual_report_2020.pdf https://assets.publishing.service.gov.uk/government/uploads/... [2] https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/790270/HCSEC_OversightBoardReport-2019.pdf https://assets.publishing.service.gov.uk/government/uploads/...