Aito M7

Security Grade

Calculator v1

AITO M7

   Brand: AITO (Parent: Seres Group)

   Category: Car • Model / Gen: New Model (2024) Plus, Max, Ultra

   Release Date: 2023-09-12 • Status: In sale

   Classification Date: 2025-10-05 • Official Website

Security Evaluation

Criterion	Value	Proof	Comment
Known hardware tampering	None	🔗 Proof	A complex, integrated vehicle system. Physical tampering would require specialized tools and knowledge, and would be immediately evident. No reports of supply chain tampering.
Known vulnerabilities	Rare	🔗 Proof	The vehicle's software is a closed ecosystem. Huawei has a mature PSIRT process to manage vulnerabilities, which are addressed via mandatory OTA updates.
Prior attacks	None	🔗 Proof	No publicly documented, widespread security breaches that have successfully compromised AITO vehicles remotely
Updatability	Very common	🔗 Proof	Vehicle receives frequent Over-the-Air (OTA) updates for both the HarmonyOS Cockpit (infotainment) and critical driving systems like ADS (Advanced Driving System
Category Score	Score: 2 / 3

Criterion	Value	Proof	Comment
Authentication with other systems	Full	🔗 Proof	The vehicle maintains a persistent, secure connection to the AITO/Huawei cloud for remote control, diagnostics, and data synchronization
Communications	Encrypted with up-to-date encryption	🔗 Proof	All Vehicle-to-Cloud (V2C) communications are encrypted end-to-end to protect against eavesdropping and man-in-the-middle attacks
Storage	Encrypted with up-to-date encryption	🔗 Proof	Sensitive user data and vehicle information are encrypted both on the vehicle's internal storage and on the cloud servers
Category Score	Score: 1 / 3

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	Requires an AITO/Huawei account for full functionality. The vehicle supports multiple driver profiles with personalized settings
Authentication	Secure	🔗 Proof	Supports multiple authentication methods: Phone as a Key (Bluetooth/NFC), physical NFC card, facial recognition for driver profiles, and a PIN for sensitive settings.
Brute-force protection	Exist	🔗 Proof	The in-vehicle system locks out after multiple incorrect PIN attempts. The cloud account has standard server-side brute-force protection.
Event logging	Access event logged	🔗 Proof	The vehicle logs access events, driving data, and system diagnostics (similar to an event data recorder or "black box"). Cloud access is also logged.
Passwords	Require change after setup with complexity requirements	🔗 Proof	The AITO/Huawei account requires a password meeting complexity rules. The in-vehicle system requires a separate PIN to be set up
Category Score	Score: 1 / 3

Property	Details
Operating System & App	HarmonyOS Cockpit (Companion App: AITO App (for iOS and Android))
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity:
Physical (Dimensions & Mass)	Dimensions: 5020 x 1945 x 1760 mm • Mass: 2340 kg