I'd hardly presume Huawei is a front for a foreign intelligence service, but their software for cellular basestations is extremely vulnerable (hundreds of different vulnerable versions of OpenSSL sprinkled through) and they still can't be bothered to use version control, despite committing to address both issues back in 2012: https://www.latimes.com/business/technology/la-fi-huawei-bri...

Huawei's products are vulnerable by default, anyone can look up the applicable CVEs and run the proof of concept code for said CVE to pop a shell. China doesn't have exclusive access :)