Readiness report

sensor.community airRohr Air Quality Sensor · 2026-09-04 00:09 · complete · 23 searches, 17 pages fetched

Download PDF

Cybersecurity — software & network: Review before networking · 6 findings

Details in the Cybersecurity section of the report below.

Readiness: sensor.community airRohr Air Quality Sensor

Verdict: Ready with caveats · 2026-09-03 · est. parts cost $43–$70 (standard build) Cybersecurity — software & network: Review before networking

This is the cold check for this lab — there is no previous report, so everything below is the baseline the next check will measure drift against. Every part needed for the standard build (a NodeMCU ESP8266 board, one particulate sensor, one temperature/humidity sensor, a micro-USB data cable, a 5 V supply and a strip of jumper wires) can be bought today, and most of the optional sensors are in stock at authorized distributors. Three things keep this off a clean "Ready": the two headline items — the NodeMCU board and the Nova Fitness SDS011 dust sensor — have no authorized distributor at all and come only from retail and marketplace sellers whose prices vary by roughly 1.7×; the legacy BMP180 pressure option is obsolete at every distributor and needs the BME280 substitute the firmware already auto-detects; and the optional Heltec WiFi LoRa 32 V2 board is no longer the version its own vendor sells. None of these blocks the lab.

Action required

Part Problem Recommended action
Bosch BMP180 breakout (legacy pressure option) Obsolete at Bosch and at every reseller; zero distributors with stock (DigiKey 14-week factory lead, Mouser out of stock), ECIA lifecycle risk High Substitute the BME280 breakout, $14.95. The firmware auto-detects it and the snapshot already names BME280/BMP280 as the BMP180's successor. See Substitutes.
Heltec WiFi LoRa 32 V2 (optional ESP32+LoRa target, qty 0) Vendor's product page now sells only the V3 (ESP32-S3 + SX1262); the V2 the firmware environment names is gone Do not plan new builds on this target. The V3 is a different MCU and a different radio — not a substitute. Use the ESP8266 build.
Nova Fitness SDS011 (primary PM sensor) No ECIA-authorized distributor lists it; retail/marketplace only, $20.83–$35.36, with one outlier listing far below the rest Budget about $21–$35 and buy from a seller with a return policy. Order spares — this is the lab's single-source part.
Plantower PMS7003 Only listing at an authorized distributor has stock 7, at $60.07 — 50% more than the whole PMS5003 kit For a Plantower build use the PMS5003 kit, $39.95 instead.
Honeywell HPMA115S0-XXX ECIA lifecycle risk High, and the same part number is listed at $250.28 (Active) and $67.76 (Obsolete) on the same distributor If this option is wanted, order at $67.76 from the Mouser channel (99 in stock); do not pay the $250.28 listing. Do not design a new class set around it.

Cybersecurity — software & network

Review before networking — The firmware ships with no web-interface password and an open setup access point, and neither the firmware nor its Arduino libraries are covered by any advisory database - but every problem found has a documented fix in the device's own configuration panel.

Component Version How known Support status
airrohr-firmware NRZ-2024-134-B5 read from project (airrohr-firmware/Versions.md (fetched/03-Versions.md); NRZ-2024-134-B5 is the newest changelog entry) —
airrohr-update-loader not determined not determined (no version appears in any file fetched this run) —
PlatformIO platform-espressif8266 2.6.2 read from project (airrohr-firmware/platformio.ini line 91: platform_version = espressif8266@2.6.2) —
PlatformIO platform-espressif32 1.11.1 read from project (airrohr-firmware/platformio.ini line 92: platform_version_esp32 = espressif32@1.11.1) —
ESP8266 Arduino Core 2.7.4 inferred (not pinned directly; Versions.md entry NRZ-2024-134-B5 reads 'Go back to Arduino Core 2.7.4', and platformio.ini pins only the platform package) —
paulstoffregen/OneWire 2.3.5 read from project (airrohr-firmware/platformio.ini line 48) —
marcoschwartz/LiquidCrystal_I2C 1.1.4 read from project (airrohr-firmware/platformio.ini line 49) —
adafruit/Adafruit BMP085 Library 1.0.1 read from project (airrohr-firmware/platformio.ini line 50) —
adafruit/Adafruit HTU21DF Library 1.1.2 read from project (airrohr-firmware/platformio.ini line 51) —
adafruit/Adafruit SHT31 Library 2.2.0 read from project (airrohr-firmware/platformio.ini line 52) —
milesburton/DallasTemperature 3.9.1 read from project (airrohr-firmware/platformio.ini line 53) —
sparkfun/SparkFun SCD30 Arduino Library not determined unpinned (airrohr-firmware/platformio.ini line 54 declares the caret range '^1.0.13'; the build resolves whatever is current) —
bblanchon/ArduinoJson 6.18.3 read from project (airrohr-firmware/platformio.ini line 55) —
ThingPulse ESP8266 and ESP32 OLED driver for SSD1306 displays not determined unpinned (airrohr-firmware/platformio.ini line 56 declares the caret range '^4.3.0'; the build resolves whatever is current) —
mikalhart/TinyGPSPlus 1.0.2 read from project (airrohr-firmware/platformio.ini line 57) —
ESP8266 core libraries (Hash, Wire, ESP8266WiFi, DNSServer, ESP8266HTTPClient, ESP8266WebServer, ESP8266mDNS, EspSoftwareSerial) not determined not determined (listed without versions in airrohr-firmware/platformio.ini lines 61-68; supplied by the Arduino core) —
ESP32 core libraries (Wire, WiFi, DNSServer, WiFiClientSecure, HTTPClient, FS, SPIFFS, WebServer, Update, ESPmDNS) not determined not determined (listed without versions in airrohr-firmware/platformio.ini lines 72-81; supplied by the Arduino core) —
Component Finding Severity Fix available?
airrohr-firmware (inbound network services) The device listens on TCP port 80 for configuration, live readings, a debug log stream and a Prometheus /metrics endpoint, plus UDP 53 for captive-portal DNS in AP mode and UDP 5353 for mDNS, and the snapshot records no authentication on any of them by default. posture Mitigation only — keep the sensors on an isolated VLAN or guest segment rather than the main campus network
airrohr-firmware (outbound telemetry) The firmware changelog records the behaviour 'When system time is invalid, disable TLS verification', so if the device's clock has not been set the certificate checks on its uploads to Sensor.Community, Madavi and other endpoints can be skipped. posture Mitigation only — let the device reach an NTP server (UDP 123) so its clock is valid before it starts reporting
airrohr-firmware (setup access point) When the configured Wi-Fi is not reachable the sensor opens its own network named airRohr-[Sensor-ID], and the firmware's own documentation says that network is unencrypted by default, so for roughly ten minutes anyone within radio range can join it and reach the setup page at http://192.168.4.1/. posture Mitigation only — set a WPA2 password for AP mode in the configuration panel, and do first-time setup somewhere not overlooked by the public
airrohr-firmware (web configuration interface) The firmware changelog records 'Change default password for webpage auth to ""', so the built-in web server ships with no password on its configuration page until someone sets one, and anybody who can reach the device on the network can reconfigure it and read the Wi-Fi credentials stored on it. posture Mitigation only — set a web basic-auth user and password in the configuration panel before the device joins a shared network
External Arduino driver libraries dependencies unpinned: 2 of 10 in platformio.ini — the SparkFun SCD30 library (^1.0.13) and the ThingPulse SSD1306 driver (^4.3.0) resolve to whatever version is current when the firmware is built, so two of the libraries compiled into the device have no fixed version anyone can check later. posture Mitigation only — pin versions / use the lockfile
PlatformIO platform-espressif8266 The build pins the ESP8266 toolchain to platform version 2.6.2 while the platform's public release list now starts at 4.2.1, so the compiler, SDK and Arduino core this device is built from are several major versions behind and no advisory database or support calendar covers them. posture Mitigation only — treat the toolchain as frozen and isolate the device; the pin is deliberate (the changelog records reverting to Arduino Core 2.7.4 to fix stalling OTA downloads), so do not simply bump it

What this means for your lab

This sensor is a small web server on wheels. Out of the box it has no password on its configuration page - the project deliberately set the default web password to an empty string - and when it cannot find its configured Wi-Fi it opens its own unencrypted Wi-Fi network for about ten minutes so you can set it up. Anyone else on the same network, or within Wi-Fi range during that setup window, can therefore open the device's page, see its live readings and debug log, change where it sends data, and read the Wi-Fi network name and password you saved into it. That last part is what matters most: if you set it up with a staff or campus Wi-Fi password, that password is sitting on a device with no login. Before you put these on a network, set a password for the web page and a WPA2 password for the setup access point in the configuration panel, and ask campus IT for an isolated or guest network segment for the sensors rather than the main one. Beyond that, the firmware and all ten of its Arduino driver libraries come from ecosystems that publish no vulnerability advisories at all, so nothing here was checked against a security database - that is an honest gap, not a clean bill of health, and it is a good reason to keep these devices off any network that matters.

Not checked

  • airrohr-firmware NRZ-2024-134-B5: vendor/citizen-science firmware: no vulnerability advisory database publishes advisories for it, so the absence of findings is not evidence of safety
  • airrohr-update-loader: no version stated in any file fetched this run
  • External Arduino driver libraries (10 entries in platformio.ini): no centralized vulnerability advisory registry covers the Arduino library ecosystem, so even the eight exactly pinned versions could not be checked against advisories
  • sparkfun/SparkFun SCD30 Arduino Library: caret range ^1.0.13 - no exact version to check
  • ThingPulse ESP8266 and ESP32 OLED driver for SSD1306 displays: caret range ^4.3.0 - no exact version to check
  • ESP8266 and ESP32 bundled core libraries: carry no versions of their own; they ship with the Arduino core, and no advisory database covers them
  • ESP8266 Arduino Core 2.7.4: version inferred from the changelog rather than pinned, and no advisory database or endoflife.date product covers the Espressif Arduino cores
  • espressif8266 2.6.2: support status: endoflife.date has no such product
  • espressif32 1.11.1: support status: endoflife.date has no such product

Parts

Microcontroller development boards

Part Spec/Package Status Stock Price Source
NodeMCU v2 / v3 (ESP8266 ESP-12E/12F) 30-pin DIP module, 5 V in, 3.3 V logic, needs 4 MB flash readily available (retail only) not published $3.44–$10.00 Jameco $10.00, Tri-Tek $9.95, circuitrocks $3.44, SunFounder $4.97, Elecrow $4.10 (shopping)
Wemos / Lolin D32 Pro (ESP32-WROVER) — qty 0, optional 32-pin DIP, 16 MB flash, 8 MB PSRAM readily available (retail only) not published $30.85 PMD Way (shopping); Newegg $32.26
Heltec WiFi LoRa 32 V2 — qty 0, optional 36-pin DIP, ESP32 + SX1276/78, 0.96 in OLED obsolete / superseded at vendor — V3 replacement listed $17.90–$19.90 heltec.org — page now sells V3 only

Particulate matter sensors

Part Spec/Package Status Stock Price Source
Nova Fitness SDS011 (primary) 71×70×23 mm module, 5-pin 2.54 mm, 4.7–5.3 V available, retail/marketplace only not published $20.86 eBay (shopping); range $20.83–$35.36. No ECIA-authorized distributor lists this part.
Plantower PMS5003 (family PMS1003/3003/5003/6003) 50×38×21 mm, 8-pin 1.25 mm — kit adds 2.54 mm adapter + cable readily available in stock $39.95 Adafruit 3686, "PM2.5 Air Quality Sensor and Breadboard Adapter Kit"
Plantower PMS7003 48×37×12 mm, dual-row 10-pin 1.27 mm available, very low stock 7 $60.07 DigiKey — Soldered Electronics 108978, Active
Honeywell HPMA115S0-XXX 43×36×23.7 mm, 8-pin 1.25 mm, 4.9–5.1 V available but overpriced; lifecycle risk High 190 (Active listing) / 24 + Mouser 99 at $67.76 $250.28 Active listing; same MPN $67.76 elsewhere DigiKey (both listings) + ECIA: Mouser 99, DigiKey 24, Sager 19, Powell 13
Sensirion SPS30 40.6×40.6×12.2 mm, ZHR-5, I2C mode, 4.5–5.5 V readily available 3856 $38.99 DigiKey — Sensirion AG, Active
Tera Sensor Next PM enclosed module, UART, 5 V not checked — — Vendor site live and NextPM is a current line, but no price or distributor is published
Piera Systems IPS-7100 enclosed module, UART, 5 V available, expensive 104 $127.51 DigiKey — Piera Systems IPS-7100-1, Active (note the "-1" variant code)

Temperature, humidity and pressure sensors

Part Spec/Package Status Stock Price Source
Aosong DHT22 / AM2302 4-pin 2.54 mm or 3-pin breakout, 3.3–5.5 V readily available as a module 591 $8.90 DigiKey — DFRobot SEN0137 "Gravity DHT22 with 20 cm cable", Active. Seeed Grove $7.38 (152), Gearbox Labs $10.00 (90). No bare Aosong listing exists.
Maxim / ADI DS18B20+ TO-92-3, 3.0–5.5 V, 1-Wire, needs 4.7 kΩ pull-up readily available 5215 $7.35 DigiKey — Active, exact match. Also Rochester 20230 at $3.80 (25-qty break); waterproof probe version $5.25
Bosch BME280 / BMP280 breakout 15×12 mm breakout, 2.54 mm header, I2C, 3V3 rail readily available 2603 $14.95 DigiKey — Adafruit 2652, Active, supply 3V–5V. SparkFun Qwiic 15440 $16.95 (470).
Bosch BMP180 breakout (legacy) 4/5-pin breakout, 1.8–3.6 V, I2C obsolete — no stock anywhere 0 $9.95 (obsolete listing) All listings Obsolete: Bosch BMP180, Adafruit 1603, DFRobot TOY0058, Seeed 101020072. ECIA: zero distributors with stock.
TE HTU21D / Si7021 breakout 4-pin 2.54 mm breakout, 1.5–3.6 V, I2C 0x40 readily available 123 $10.95 DigiKey — Adafruit 1899 HTU21D-F breakout, Active. Bare TE HPP845E031R4 $7.28 (6004) is SMD only.
Sensirion SHT3x (SHT30/31/35) breakout 4/6-pin 2.54 mm breakout, 2.15–5.5 V, I2C 0x44/0x45 readily available in stock $13.95 Adafruit 2857 SHT31-D breakout. DigiKey stocks only bare reel parts (SHT31-DIS-B2.5KS $4.50, 18514).
Sensirion SCD30 (CO2) 35×23×7 mm, 7-pin 2.54 mm, 3.3–5.5 V, I2C readily available 6682 $47.36 DigiKey — Sensirion AG, Active

Optional peripherals

Part Spec/Package Status Stock Price Source
DNMS acoustic noise sensor dedicated board, MEMS mic, I2C/serial not a purchasable part — self-build — — github.com/hbitter/DNMS — firmware and PCB layouts only; needs a Teensy 3.6/4.0 and self-fabricated PCB. Watterott sells the IM72D128 microphone module.
u-blox NEO-6M GPS breakout ~25×35 mm breakout, 2.54 mm, 3.3 V only, 9600 baud available, retail/marketplace only not published $12.45 eBay (shopping); ShillehTek $13.99, Walmart $12.07–$15.91. No authorized distributor listing.
OLED display (SSD1306/SH1106, 128×64, I2C) 4-pin breakout, 2.54 mm, 3.3–5 V readily available in stock $19.95 Adafruit 938, 1.3 in 128×64 SSD1306, I2C default, 3–5 V level shifted
LCD1602 / LCD2004 with PCF8574 I2C backpack HD44780 module + 4-pin backpack, 5 V, addr 0x27/0x3F readily available not published $4.95 Ameridroid (shopping); Micro Center $4.99, PiShop $4.95, Waveshare $6.49

Power, cable and interconnect

Part Spec/Package Status Stock Price Source
USB 2.0 A to Micro-B data cable 1.0–2.0 m, intact D+/D− readily available in stock $2.95 Adafruit 592, 3 ft / 1 m, USB 1.1/2.0 data cable
5 V USB wall adapter, ≥ 1 A 100–240 V AC in, 5 V DC ≥ 1000 mA out readily available in stock $5.95 Adafruit 501, UL listed, 1000 mA, outputs 5.25 V to offset cable drop
Female–female DuPont jumper wires, 2.54 mm 10–20 conductors, 10–20 cm, 24/28 AWG readily available in stock $1.95 Adafruit 1950, 20 × 150 mm, 28 AWG, 0.1 in female both ends

Substitutes

For part Substitute Differences Verified Judgment
Bosch BMP180 breakout (obsolete) Bosch BME280 breakout — Adafruit 2652, $14.95, stock 2603 Supply: BMP180 wants 1.8–3.6 V on the 3V3 rail; the BME280 breakout's supply parameter is 3 V–5 V, which contains the lab's 3.3 V rail. Interface: both I2C on D4 (GPIO2) / D3 (GPIO0). Function: BME280 adds relative humidity on top of pressure and temperature — exceeds the requirement, which is acceptable. Firmware: the snapshot says the firmware auto-detects which sensor is fitted and names BME280/BMP280 as the BMP180's successor. Physical: the build uses no PCB and is point-to-point DuPont-wired, so board outline is not a constraint — but header pin order differs between breakouts and will need rewiring. verified: supply-voltage range against the lab's 3.3 V rail (DigiKey parameters on Adafruit 2652, "3V ~ 5V"), lifecycle/price/stock (DigiKey, Active, $14.95, stock 2603), I2C interface and firmware auto-detection (snapshot), no-PCB build so no footprint constraint (snapshot fabrication section). Not verified: header pin order / pinout — no pinout data for either board is in the evidence, so this is not a rewire-free drop-in. Acceptable
Bosch BMP180 breakout (obsolete) TDK InvenSense ICP-20100 (DigiKey's own suggested substitute) Package 10-LGA against the BMP180's 7-VLGA — a different footprint, and a bare surface-mount die with no breakout in evidence. The substitute record carries no price, no lifecycle status and no stock. Decisive point: the lab drives its pressure sensor through the Adafruit BMP085 library, which has no ICP-20100 support. verified: package/case of both parts (DigiKey parameters — BMP180 7-VLGA, ICP-20100 described 10LGA), library support (snapshot). Not verified: nothing further — the footprint mismatch and absent driver ended the comparison. Rejected
Heltec WiFi LoRa 32 V2 (superseded) Heltec WiFi LoRa 32 V3, $17.90–$19.90 The fetched V3 specification gives master chip ESP32-S3FN8 and LoRa node chip SX1262, where the snapshot specifies the V2 as an ESP32 (ESP-WROOM-32) with an SX1276/SX1278 transceiver. Different MCU and different radio silicon, and the snapshot requires "exactly the Heltec WiFi LoRa 32 V2 platform" for that firmware environment. verified: MCU part and LoRa transceiver part (fetched Heltec V3 specification table) against the V2's MCU and transceiver (snapshot). Not verified: pinout, footprint, and whether the airRohr firmware has any V3 build environment — none of that is in the evidence. Rejected — hard stop

Verify any substitute against its datasheet and its own pinout before ordering; the checks above are only as good as the evidence named in the Verified column.

Other dependencies

  • Firmware source repository — github.com/opendata-stuttgart/sensors-software: live. The listing this run resolved branch master and returned 62 entries under airrohr-firmware/. Note a snapshot discrepancy worth correcting: the snapshot records platformio_script.py as "missing from the repository workspace files", but it is present upstream in airrohr-firmware/ — it is missing from the uploaded lab materials, not from the project.
  • Sensor configuration instructions — Konfiguration der Sensoren wiki: live, fetched successfully.
  • NodeMCU v2/v3 pinout documentation — Pinouts NodeMCU v2, v3 wiki: live, fetched successfully. Last edited 21 February 2017; its substantive content is the warning that on a v3 board the 5 V sensor lead must go to VU, not VIN.
  • Sensor.Community device registration portal — devices.sensor.community: live, still offering self-service sensor configuration plus links to the map and CSV archive.
  • PlatformIO platform-espressif8266 release archive — github.com/platformio/platform-espressif8266/releases: live; the release list now starts at 4.2.1.
  • NodeMCU v3 / SDS011 wiring schematic (nodemcu-v3-schaltplan-sds011.jpg): not checked — a JPEG image, and the page-fetch tool extracts text only.
  • Maxim DS18B20 datasheet (datasheets.maximintegrated.com/en/ds/DS18B20.pdf): not checked — a PDF, and the page-fetch tool extracts text only. Worth an eye next check: Maxim datasheet URLs have been migrating to analog.com.
  • Fabrication: no custom PCB is required. The standard build is point-to-point DuPont wiring of COTS modules inside an enclosure, so there is no board house and no gerber to go stale. Two physical notes carry forward: NodeMCU v2 (0.9 in row pitch) and v3 (1.1 in) are not interchangeable on rigid perfboard or a prototyping shield, and the optional DNMS noise module is the one item that does require self-fabricated PCBs.

Watch list

  • Nova Fitness SDS011 — the lab's headline sensor, single manufacturer, no authorized distribution at all. Every price in this report came from eBay and AliExpress sellers. This is the part most likely to become a problem, and it has no substitute recorded here.
  • Bare Bosch BME280 die — zero stock at every authorized distributor today (DigiKey 0 on a 12-week factory lead, Mouser 0 with 334,609 on order, Future 0; supply-chain risk Med). Breakout boards are plentiful and unaffected, so this does not bite yet — but if the shortage reaches the breakout makers it takes out both the recommended environmental sensor and the BMP180 substitute at once.
  • Honeywell HPMA115S0-XXX — ECIA lifecycle risk High, with the same part number carrying an Obsolete listing alongside the Active one. Expect this option to disappear.
  • Plantower PMS7003 — stock of 7 at the only authorized listing will not survive a class order.
  • NodeMCU boards generally — commodity clones with no manufacturer part number, so there is nothing to track between checks and no listing in evidence confirms the 4 MB flash the firmware's 3 MB SPIFFS layout requires. Confirm flash size at order time.
  • Heltec V2 and Tera Sensor Next PM — one is gone from its vendor's catalogue and the other publishes no price; both are optional, but neither will get easier.