Huawei Technologies Co. Ltd. is facing a fresh round of scrutiny, this time in the United Kingdom.

British cybersecurity watchdog HCSEC today issued a scathing report warning of “significant technical issues” in the Chinese telecommunications equipment maker’s gear. It’s the fifth assessment of Huawei gear produced thus far by the body, which was established in 2010 through an agreement between the company and the U.K. government to address authorities’ security concerns.

The 46-page report comes at a time when Huawei is facing mounting regulatory pressure around the world. The U.S. and several other countries have banned network operators from using Huawei gear, citing national security concerns over the company’s ties to the Chinese government. HSCSEC’s new assessment does not call on U.K. authorities to take the same step, but flags “serious and systematic defects” in Huawei’s internal cybersecurity procedures.

The watchdog shared several examples of such problems. In a visit to one of Huawei’s engineering facilities, for instance, HSCSEC officials found that the company was using dated versions of the OpenSSL encryption tool with known security vulnerabilities.

“If an attacker has knowledge of these vulnerabilities and sufficient access to exploit them, they may be able to affect the operation of the network, in some cases causing it to cease operating correctly,” the body warned. “Other impacts could include being able to access user traffic or reconfiguration of the network elements.”

On another occasion, the watchdog discovered inconsistencies in the company’s software build workflow, the phase of development during which raw code is turned into usable programs. HSCSEC said that makes it impossible to determine reliably what code makes it into Huawei products. That lack of transparency, in turn, can make it difficult to verify that security requirements are met. 

“The Oversight Board [HSCSEC] advises that it will be difficult to appropriately risk-manage future products in the context of U.K. deployments, until the underlying defects in Huawei’s software engineering and cyber security processes are remediated,” the watchdog wrote.

HSCSEC also reprimanded Huawei for failing to make progress on a $2 billion initiative it launched last year to address security issues flagged by U.K. authorities. In a statement responding to today’s report, the company said that “we understand these concerns and take them very seriously” while reiterating its commitment to the security initiative. 

Photo: Open Grid Scheduler/Flickr