XPeng G6

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	None	🔗 Proof	Integrated vehicle system where unauthorized physical tampering is extremely difficult and would be immediately detectable. No public reports of supply chain tampering.
Known vulnerabilities	Rare	🔗 Proof	XPeng runs a dedicated security response center and bug bounty program. Vulnerabilities are addressed via mandatory Over-the-Air (OTA) updates.
Prior attacks	None	🔗 Proof	No publicly documented, widespread security breaches have successfully compromised the XPeng vehicle platform.
Updatability	Very common	🔗 Proof	A core feature (XOTA). The vehicle receives frequent and comprehensive OTA updates for the Xmart OS infotainment system and the XNGP advanced driving system.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Full	🔗 Proof	The vehicle maintains a persistent, secure connection to the XPeng cloud for remote control, vehicle diagnostics, and data-driven services.
Communications	Encrypted with up-to-date encryption	🔗 Proof	All data communication between the vehicle, the cloud, and the companion app is protected by end-to-end encryption using industry-standard protocols.
Storage	Encrypted with up-to-date encryption	🔗 Proof	Sensitive user data, including biometric information and driving data, is encrypted at rest both on the vehicle's internal storage and in the cloud.
Category Score	Score: 1 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	An XPeng account is mandatory for all smart features. The system supports multiple driver profiles with personalized settings.
Authentication	Secure	🔗 Proof	Supports multiple authentication methods: Phone as a Key (PaaK via Bluetooth/NFC/UWB), NFC card, facial recognition for driver profile login, and a PIN for sensitive vehicle settings.
Brute-force protection	Exist	🔗 Proof	The in-vehicle system locks out after multiple incorrect PIN attempts. The cloud account has standard server-side brute-force protection.
Event logging	Access event logged	🔗 Proof	The vehicle maintains comprehensive diagnostic and access logs. The cloud service logs all account access events for security auditing.
Passwords	Require change after setup with complexity requirements	🔗 Proof	The required XPeng account enforces password complexity. An in-vehicle PIN for sensitive operations must be set by the user.
Category Score	Score: 1 / 3

Technical Specifications

Property	Details
Operating System & App	Xmart OS (Companion App: XPeng App)
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity:
Physical (Dimensions & Mass)	Dimensions: 4753 x 1920 x 1650 mm • Mass: ~1995 - 2100 kg