Readiness report
openWB EV Wallbox and Home Energy Manager · 2026-09-03 02:17 · complete · 10 searches, 19 pages fetched
Cybersecurity — software & network: Do not place on an open network · 11 findings
Details in the Cybersecurity section of the report below.
Readiness: openWB EV Wallbox and Home Energy Manager
Verdict: Ready with caveats · 2026-09-03 · est. parts cost insufficient pricing (priced lines $105–$168 plus €235 for the meter; the EVSE DIN controller and the turnkey wallbox are unpriced) Cybersecurity — software & network: Do not place on an open network
Every part this lab needs can be bought today, and nothing on the bill of materials is unobtainable. The caveats are about where you buy, not whether you can. Four lines — the Raspberry Pi, the SD card, the power supply and the optional RFID reader — are ordinary retail items available from many sellers at commodity prices. The other four are European DIN-rail energy hardware, and each carries a wrinkle: the Phoenix Contact EVSE controller the lab's notes name as an example is now obsolete with zero stock at any authorized distributor; the EVSE DIN controller openWB actually sells, and openWB's own turnkey wallbox, are sold through small German shops whose listed prices could not be captured, so those two lines have no price on record; the Eastron meter is not carried by any authorized electronics distributor at all and is priced only in euros; and the Finder contactor, while active and in stock, is thin (12 units across two distributors) and its three-phase 400 V rating is not confirmed by the distributor data. This is the cold check — no previous report exists, so these figures establish the baseline that future checks will measure drift against.
Action required
| Part | Problem | Recommended action |
|---|---|---|
| Phoenix Contact EM-CP-PP-ETH (2902802) | Obsolete at DigiKey; 0 stock at DigiKey (13-week factory lead), Master Electronics (8-week lead) and Mouser; ECIA lifecycle risk High | Do not design around this part. Use the Simple EVSE DIN with RS485 Modbus that openWB sells, or the EVSE WBDIN RS485 controller — both are what the openWB software is built around. See Substitutes for the Phoenix successor. |
| EVSE DIN charge controller (openWB / EVSE-WiFi) | No price on record — both shop pages fetched fine but their price elements are not in the extracted text, and no distributor carries the part | Request a quote from the shop before budgeting. The product is live and listed as delivered pre-configured. |
| Eastron SDM630 Modbus V2 meter | Not carried by any ECIA-authorized distributor; only a EUR price is on record | Order through a solar/metering reseller and budget import lead time and currency conversion. |
| Finder 22.34.0.230.4320 contactor | Only 12 units across two authorized distributors; the 400 V phase-to-phase rating is not established by the distributor parametrics | Fine for one or two charge points; order early for a class set. Confirm the 400 V three-phase rating on Finder's datasheet before wiring mains. |
| openWB series2 standard+ wallbox | No price on record — the shop page's price element could not be extracted | Request a quote from openWB directly. This is the alternative turnkey route, not a required part. |
Cybersecurity — software & network
Do not place on an open network — The MQTT broker accepts anonymous connections on all interfaces and ships a published default administrator password, and the required Debian 11 platform stopped receiving security updates on 2026-08-31 — none of which can be fixed within the lab's own documented constraints.
| Component | Version | How known | Support status |
|---|---|---|---|
| Debian GNU/Linux 11 "Bullseye" / Raspberry Pi OS Lite | 11 | inferred (Required by the lab's documentation per the snapshot; the fetched install scripts install packages against whatever ${VERSION_CODENAME} is present rather than pinning a release.) | unsupported since 2024-08-14 |
| PHP | 7.4 | read from project (fetched openwb-install.sh lines 101-107 write the upload-limit ini into /etc/php/7.4/apache2/conf.d/ (falling back to /etc/php/7.3/).) | unsupported since 2022-11-28 |
| Apache HTTP Server 2 (with ssl, proxy_wstunnel, headers) | not determined | unpinned (fetched runs/install_packages.sh installs apache2 and libapache2-mod-php from apt with no version; fetched runs/setup_apache2.sh enables ssl and proxy_wstunnel.) | — |
| Eclipse Mosquitto MQTT broker | not determined | unpinned (fetched runs/install_packages.sh adds repo.mosquitto.org as an apt source and installs mosquitto/mosquitto-clients unversioned.) | — |
| openWB 2 application core | not determined | unpinned (fetched openwb-install.sh clones https://github.com/openWB/core.git --branch master; no tag or commit is pinned.) | — |
| openWB prebuilt Raspberry Pi disk image | not determined | not determined (link.openwb.de/lateststableimage is a floating redirect to the current stable image; no version is stated and the redirect was not followed this run.) | — |
| aiohttp | 3.13.4 | read from project (pinned in the fetched requirements.txt) | — |
| pytest | 8.4.2 | read from project (pinned in the fetched requirements.txt) | — |
| pymodbus | 2.5.3 | read from project (pinned in the fetched requirements.txt) | — |
| umodbus | 1.0.4 | read from project (pinned in the fetched requirements.txt) | — |
| paho_mqtt | 1.6.1 | read from project (pinned in the fetched requirements.txt) | — |
| ocpp | 1.0.0 | read from project (pinned in the fetched requirements.txt) | — |
| websockets | 12.0 | read from project (pinned in the fetched requirements.txt) | — |
| cryptography | 50.0.0 | read from project (pinned in the fetched requirements.txt) | — |
| evdev | 1.5.0 | read from project (pinned in the fetched requirements.txt) | — |
| Component | Finding | Severity | Fix available? |
|---|---|---|---|
| aiohttp | The pinned aiohttp 3.13.4 — the HTTP and WebSocket client openWB uses to reach inverters, vehicle cloud APIs and OCPP endpoints — is affected by 14 published advisories, including an out-of-bounds heap read in its C HTTP response parser when a server returns a malformed chunked response. — GHSA-CQ5V-8Q36-5273, GHSA-4FVR-RGM6-GQMC, GHSA-63HW-FMQ6-XXG2, GHSA-G3CQ-J2XW-WF74 (+2 more) | high | No — project pins aiohttp==3.13.4 (fixes land in 3.14.0 through 3.14.3 and would need an upstream bump) |
| pytest | pytest 8.4.2 ships in the same requirements file that is installed on the device and has a vulnerable temporary-directory handling issue; it is a test tool rather than something reachable over the network, so the practical risk here is low. — GHSA-6W46-J5RX-G56G | moderate | No — project pins pytest==8.4.2 (fixed in 9.0.3) |
| Apache HTTP Server 2 and Eclipse Mosquitto (TLS) | Both the HTTPS web interface and the TLS MQTT listeners are configured with Debian's self-signed 'snakeoil' certificate, so nothing a browser or client connects to can be verified as the real charger and every user is trained to click through the warning. | posture | Mitigation only — install a certificate from your institution's CA, or keep the device off shared networks. |
| Debian APT packages (apache2, libapache2-mod-php, php, mosquitto) | The entire network-facing stack is installed unversioned from apt on an operating system that no longer receives security updates, so no version could be checked and no fixes are coming. | posture | Mitigation only — track and patch these packages yourself, or move the lab to a supported OS image. |
| Debian GNU/Linux 11 "Bullseye" | openWB requires Debian 11, whose standard support ended 2024-08-14 and whose extended LTS security support ended 2026-08-31, so the host operating system now receives no security updates at all — and openWB's documentation states newer Debian releases are not supported. | posture | No — requires platform migration |
| Eclipse Mosquitto MQTT broker | The installer seeds the broker with a fixed administrator account 'admin' whose password 'openwb' is printed by the setup script and shipped as a hard-coded hash, and that account holds the dynsec-admin and full-access roles. | posture | Mitigation only — change the admin password immediately after installation, before the charger touches any network. |
| Eclipse Mosquitto MQTT broker | The public MQTT listener on port 8883 and the public WebSocket listener on port 9002 are configured with no bind address and allow_anonymous true, so any host on the same network can connect to the charger's message bus without credentials. | posture | Mitigation only — isolate the charger on its own network segment and block ports 8883 and 9002 at the network boundary. |
| openWB 2 application core | The installer creates the system user 'openwb' with unrestricted passwordless sudo (openwb ALL=(ALL) NOPASSWD: ALL) and sets no password for the account, so anything running as that user has full root on the device. | posture | Mitigation only — set a password for the openwb account and narrow its sudoers entry to the commands openWB actually needs. |
| openWB 2 application core | Installation pipes a script downloaded from the master branch straight into bash and then clones master, so what lands on the device is whatever was in the repository at that moment, with no signature, tag or checksum verified. | posture | Mitigation only — review the install scripts and check out a release tag rather than master before running them on lab hardware. |
| openWB remote support and simpleAPI services | The installer enables and starts openwbRemoteSupport.service and openwb-simpleAPI.service automatically, and the snapshot records that their listening ports are not stated anywhere in the sources. | posture | Mitigation only — disable openwbRemoteSupport and openwb-simpleAPI unless they are wanted, and port-scan the device before it joins a campus network. |
| PHP | The web interface runs on PHP 7.4, which reached end of life on 2022-11-28 and has received no upstream security fixes since. | posture | No — requires platform migration |
What this means for your lab
Treat this charger as an untrusted device on your network until you have hardened it. Out of the box its message bus accepts connections from anyone on the same network without a password, and it ships with a published administrator login (user 'admin', password 'openwb') that grants full control — so a student, a guest on the campus Wi-Fi, or anything else on that subnet could read the charger's live data and, with the published password, start and stop charging or change its settings. The operating system it requires, Debian 11, stopped receiving security updates on 31 August 2026, and the PHP version behind its web interface stopped in 2022, so neither will be patched again. The HTTPS certificate is self-signed, meaning nobody can tell a real charger from an impostor. Before you connect this to anything: change the MQTT admin password, set a password on the 'openwb' system account, turn off the remote-support service if you do not want it, and ask campus IT to put the charger on its own isolated network segment rather than the general campus network. None of this makes the lab unusable — it makes it a lab that has to live behind its own boundary.
Not checked
- openWB prebuilt Raspberry Pi disk image: link.openwb.de/lateststableimage is a floating redirect with no stated version; there is no version to check.
- openWB 2 application core (git master): Tracks a moving branch with no commit or tag pinned, and source-only projects have no advisory database.
- Eclipse Mosquitto (version): Installed unversioned from the upstream apt repository; no version to look up.
- Apache HTTP Server 2 (version): Installed unversioned from apt; no version to look up.
- Debian system packages: Installed unversioned by the install script; individual package versions were not determined.
- aiohttp (remaining advisories): The lookup reported 14 advisories for 3.13.4 but enumerated 6 IDs; the other 8 were not listed this run.
- SSH exposure: The snapshot records that whether SSH is instructed or enabled is not stated in the lab's sources, and nothing fetched this run settles it.
Parts
Host platform
| Part | Spec/Package | Status | Stock | Price | Source |
|---|---|---|---|---|---|
| Raspberry Pi 3 Model B / B+ | SBC, 85 × 56 mm; 5 V DC ≥ 2.5 A; 3.3 V 40-pin GPIO | readily available | multiple sellers | $35.00 | Mouser (also CanaKit, Newark at $35.00; eBay $29.00; B+ $40.00 PiShop USA, $52.59 Best Buy) |
| MicroSDHC / MicroSDXC card, 16 GB min | Class 10 / UHS-I, 3.3 V | readily available | commodity | $6.99 | eBay — SanDisk Ultra UHS-I microSDHC (PNY Elite $8.53, Team $9.99, Centon $13.99, Kodak $16.99) |
| 5 V DC power supply, ≥ 2.5 A Micro-USB | 100–240 V AC in, 5 V ±5% out, ≥ 12.5 W | readily available | multiple sellers | $4.99 | eBay — Raspberry Pi 12.5 W Micro USB PSU; official 5.1 V 2.5 A 13 W $5.90 at Newark; UL-listed HQRP $13.95 at Best Buy |
Charging hardware
| Part | Spec/Package | Status | Stock | Price | Source |
|---|---|---|---|---|---|
| EVSE DIN charge controller (openWB Simple EVSE DIN / EVSE-WiFi EVSE WBDIN) | DIN-rail EN 50022; IEC 61851-1 Type 1/Type 2; CP ±12 V 1 kHz PWM, PP sense; RS485 Modbus pre-enabled (slave ID 1) | readily available | not stated | not established | openWB shop · EVSE-WiFi shop |
| Phoenix Contact EM-CP-PP-ETH (2902802) — named example only | DIN-rail AC charge controller, Ethernet | obsolete | 0 at DigiKey, Master Electronics, Mouser | $342.34 (last DigiKey price) | DigiKey — Obsolete, 13-week factory lead; ECIA lifecycle risk High, supply-chain risk Med |
| Finder 22.34.0.230.4320 modular contactor | DIN rail; 4PST-NO (4 Form A); 25 A contact rating; 230 VAC/DC coil; 250 VAC nom switching; −20 °C to +50 °C | Active | 4 (DigiKey) + 8 (Newark) | $64.16 | DigiKey (Newark $70.98); ECIA lifecycle risk Low, supply-chain risk Low |
Metering and input
| Part | Spec/Package | Status | Stock | Price | Source |
|---|---|---|---|---|---|
| Eastron SDM630 Modbus V2 three-phase meter | Four-module DIN rail; 3 × 230/400 V; 100 A direct; RS-485 Modbus RTU + pulse; MID B and D; self-supplied | readily available (non-distributor channel) | not stated | €235,00 | SolarTopStore; specs from the Eastron product page. No ECIA-authorized distributor lists this part number |
| USB RFID reader / keypad (optional) | USB bus-powered; must appear as a Linux evdev input device | readily available; evdev compatibility not verified | multiple sellers | $13.66 | yarongtech.com — YARONGTECH MIFARE 13.56 MHz USB (also $24.69 newegg.com, SparkFun $29.95 at DigiKey, PRX-USB $59.99) |
| openWB series2 standard+ complete wallbox (alternative turnkey) | IP-rated wall-mount station; 22 kW max, limitable to 11 kW; MID meter and type B RCD integrated; automatic 1↔3 phase switching | available from the manufacturer | not stated | not established | openWB shop |
Substitutes
| For part | Substitute | Differences | Verified | Judgment |
|---|---|---|---|---|
| Phoenix Contact EM-CP-PP-ETH (2902802) — obsolete | Phoenix Contact CHARX SEC-3000 (1139022) — Active, $560.00, stock 2 at DigiKey | Manufacturer's own named successor in the same AC charge-controller family, so the IEC 61851/62196 pilot-generation role is the same. Costs 64% more than the obsolete part's last price ($560.00 vs $342.34). The lab's binding constraint is that the controller be supported by openWB's communication interfaces, and the evidence says nothing about that. | verified: lifecycle status, price and stock (DigiKey lookup this run); manufacturer-recommended-successor relationship (DigiKey substitute type "MFR Recommended"). Not verified: openWB driver/communication support; DIN module width and mounting; pilot signalling details — no parametrics block was returned and no datasheet was fetched. | Plausible successor, not verified for this lab. For an openWB build the openWB/EVSE-WiFi DIN controller is better evidenced and far cheaper; the CHARX is the answer only if you are committed to Phoenix Contact hardware. |
| Finder 22.34.0.230.4320 — thin stock | Finder 22.34.0.230.1320 — $64.16, stock 1 at DigiKey | DigiKey lists it as a "Parametric Equivalent" with the same description text, "MODULAR CONTACTOR, 4PST-NO 25A". What the ".1320" versus ".4320" variant code encodes is not stated anywhere in the evidence. | verified: manufacturer, description text, price and stock (DigiKey lookup this run). Not verified: lifecycle status, contact configuration, switching voltage, coil parametrics, footprint, and the meaning of the variant code. | Unverified — a lead to check, not a drop-in. With one unit in stock it adds no meaningful supply depth anyway. |
Verify any substitute against its datasheet before ordering — the comparisons above are made from distributor data, not from the manufacturer's full specification.
Other dependencies
- PCB fabrication: none required. The lab has no custom printed circuit boards, Gerber files, drill files or schematic design files. Assembly is wiring commercial DIN-rail modules (controller, contactor, meter, power supply) inside an electrical enclosure, or deploying onto a prebuilt openWB wallbox.
- openwb.de and openwb.de/shop — live. Two shop product pages were fetched successfully this run.
- github.com/openWB/core — live. The repository root was listed this run (19 entries) and the master branch is active. This is the site the lab downloads from; what it serves is covered under Cybersecurity above.
- Debian 11 Lite OS image archive (downloads.raspberrypi.org/raspios_oldstable_lite_armhf/images/raspios_oldstable_lite_armhf-2025-05-07/) — not checked. The archive URL was not fetched this run.
- link.openwb.de/lateststableimage — not checked. The redirect was not followed this run.
Watch list
- Phoenix Contact EM-CP-PP-ETH. Already obsolete with zero authorized stock; the remaining grey-market supply will only get worse and more expensive. Treat the line as closed.
- Finder 22.34.0.230.4320. Twelve units across two distributors is one classroom order away from zero. If you need more than a couple, order early and confirm the 400 V three-phase rating on the datasheet first.
- Raspberry Pi 3 Model B / B+. The lab is pinned to this generation because Debian 11 is hard to run on a Pi 5. As the 3B ages out of retail channels, prices will drift upward and the lab's OS constraint will become the binding problem rather than the board itself.
- Eastron SDM630 Modbus V2. No authorized-distributor coverage means no lifecycle or supply-chain signal to watch — availability can change without warning, and only a euro price is on record.
- The two unpriced lines (EVSE DIN controller, openWB series2 wallbox). Until a quote lands, this lab has no defensible total cost; getting one should be the first budgeting step.