It's hard to prove a negative, but in 2012 Reuters reported that a US classified investigation was leaked, and it said no evidence was found:
The classified inquiry was a thorough review of how Huawei worked, involving nearly 1,000 telecom equipment buyers.
One of the government employees involved with the inquiry told Reuters: "We knew certain parts of government really wanted evidence of active spying. We would have found it if it were there."
Note that the investigation still found run-of-the-mill security vulnerabilities, which could have been exploited by anyone who knew about them. And in fact were...
In 2014 evidence leaked by Snowden showed that the NSA had gained access to Huawei source code by hacking their servers:
The New York Times withheld technical details on exactly how the NSA had compromised Huawei's servers in response to national security reasons cited by the Obama administration. But a leaked NSA "spy catalog" made available on Cryptome, a website that publishes government and corporate documents, does show how the agency had already succeeded in installing software back doors in certain Huawei hardware, such as firewalls and routers, as early as 2008. The NSA catalog also reveals exploits for computer hardware belonging to U.S. companies such as Dell.
"The exploits in the NSA catalog actually mirror what the U.S. has been accusing Huawei of potentially doing to their products," Bumgarner [chief technology officer at the U.S. Cyber Consequences Unit, a non-profit research institute] says.
A joint NSA and CIA operation targeting Huawei products appears under the code name "Turbopanda" in several software exploits described by the NSA catalog. One persistent backdoor software implant named "Headwater" targets Huawei routers so that the NSA could monitor Internet traffic passing through them. Another backdoor software implant called "Halluxwater" targets Huawei's Eudemon series of hardware firewalls—computers that guard an organization's internal network from the rest of the Internet.
So the concern seems to be based on the premise "if we could do it, so could they".
Furthermore, in the US, some US corporations have been accused of preferentially informing of their security vulnerabilities to US national security agencies, before patching.
Redmond, Washington-based Microsoft (MSFT) and other software or Internet security companies have been aware that this type of early alert allowed the U.S. to exploit vulnerabilities in software sold to foreign governments, according to two U.S. officials. Microsoft doesn't ask and can't be told how the government uses such tip-offs, said the officials, who asked not to be identified because the matter is confidential.
I tried to find if Huawei has a similar practice with the Chinese government, but I couldn't find specifics.
The closest thing to direct/mass surveillance from a Chines company is probably the more recent (2016) case of Adups:
Kryptowire, the security firm that discovered the vulnerability, said the Adups software transmitted the full contents of text messages, contact lists, call logs, location information and other data to a Chinese server. The code comes preinstalled on phones and the surveillance is not disclosed to users, said Tom Karygiannis, a vice president of Kryptowire, which is based in Fairfax, Va. “Even if you wanted to, you wouldn’t have known about it,” he said.
Although Adups provides software to Huawei, it seems only the US phones of a company called BLU Products were affected by this "feature". A more recent (2017) take on this story also flagged the
Cubot phone maker, but also makes broader non-specific claims that many cheap phones (< $300) may be affected.
