I read the report itself:
- Devices came with a default username/password. Called a "backdoor."
- Devices used password auth instead of public key cryptography for SSH out of the box. Called a "backdoor."
- Default public key cryptography keys for SSH auth instead of password. Called a "backdoor."
- Devices contained public certificate authorities. Called a "man in them middle."
- Devices contained well known vulnerabilities in common open source software.
If I had paid Finite State for this report, I'd fire them on the spot and blacklist them. I particularly love the Schrödinger's cat of public key SSH auth. If the vendor doesn't enable it by default it is a "backdoor" and if they do it is "hard-coded certificates" and thus a "backdoor."
According to Finite State's logic I've never used a vendor that didn't contain multiple "backdoors." Particularly as doing so is impossible (since you need to enable public certificate SSH auth AND not provide users any way of actually using it).
The thing that surprises me is that they found "backdoors" in only 55% of devices? Shouldn't it be 100%, or did you feel like misleading that much was too unbelievable (and people might e.g. read the report and call you out)?
PS - No conflicts or stakes here (don't even run Huawei's stuff that I know of). Just decided to read the report because of the extraordinary claims made, found out there was nothing there.