Aito M5

Security Grade

Calculator v1

AITO M5

   Brand: AITO (Parent: Seres Group)

   Category: Car • Model / Gen: New Model (2024) Max, RS

   Release Date: 2024-04-23 • Status: In sale

   Classification Date: 2025-10-05 • Official Website

Security Evaluation

Criterion	Value	Proof	Comment
Known hardware tampering	None	🔗 Proof	Integrated vehicle system where physical tampering is difficult and detectable. No public reports of malicious supply chain tampering.
Known vulnerabilities	Rare	🔗 Proof	The HarmonyOS-based system is a closed ecosystem. Huawei's PSIRT team manages vulnerabilities, which are patched via mandatory OTA updates
Prior attacks	None	🔗 Proof	No publicly documented, widespread security breaches have been successful against the AITO vehicle platform.
Updatability	Very common	🔗 Proof	Receives frequent Over-the-Air (OTA) updates for the infotainment system, advanced driving system (ADS), and other vehicle functions.
Category Score	Score: 2 / 3

Criterion	Value	Proof	Comment
Authentication with other systems	Full	🔗 Proof	Maintains a secure, persistent connection to the AITO/Huawei cloud for remote control, diagnostics, and data services.
Communications	Encrypted with up-to-date encryption	🔗 Proof	All data communication between the vehicle, the cloud, and the companion app is protected by end-to-end encryption.
Storage	Encrypted with up-to-date encryption	🔗 Proof	Sensitive user and vehicle data is encrypted at rest, both on the vehicle's internal storage and in the cloud.
Category Score	Score: 1 / 3

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	A mandatory AITO/Huawei account is used for all smart features. The system supports multiple driver profiles with personalized settings.
Authentication	Secure	🔗 Proof	Supports multiple authentication methods: Phone as a Key (PaaK), NFC card, facial recognition for driver login, and a PIN for sensitive settings.
Brute-force protection	Exist	🔗 Proof	In-vehicle systems lock out after multiple failed PIN entries. The cloud account has standard server-side brute-force protection.
Event logging	Access event logged	🔗 Proof	The vehicle logs access and operational data. The cloud service logs all account access events for security auditing.
Passwords	Require change after setup with complexity requirements	🔗 Proof	The required AITO/Huawei account enforces password complexity. An in-vehicle PIN must be set by the user.
Category Score	Score: 1 / 3

Property	Details
Operating System & App	HarmonyOS Cockpit (Companion App: AITO App (for iOS and Android))
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity:
Physical (Dimensions & Mass)	Dimensions: 4785 x 1930 x 1620 mm • Mass: ~2200 - 2350 kg