Readiness report

IoT for Beginners Curriculum Kit · 2026-09-03 18:38 · complete · 52 searches, 21 pages fetched

Download PDF

Cybersecurity — software & network: Review before networking · 9 findings

Details in the Cybersecurity section of the report below.

Readiness: IoT for Beginners Curriculum Kit

Verdict: Ready with caveats · 2026-09-03 · est. parts cost $310-$340 per complete dual-track station (about $150-$190 for the Wio Terminal track alone, $200-$230 for the Raspberry Pi track alone) Cybersecurity — software & network: Review before networking

This is the cold check for this lab - there is no previous report, so everything below is the baseline the next check will measure drift against. Every load-bearing electronic module can be ordered today: the Wio Terminal is Active with 453 in stock at $36.25, and the Grove Base Hat, ReSpeaker HAT and the whole Grove sensor set are Active at an authorized distributor. Four caveats keep it off a clean "Ready". The two pre-packaged starter kits the curriculum tells instructors to buy could not be found for sale as bundles, so the kit has to be assembled part by part. The official Raspberry Pi Camera Module v2 is discontinued through authorized distribution - zero stock across ECIA distributors and a 14-week factory lead time - so it needs a retail purchase or the IMX219 substitute. The Seeed 6 V water pump is obsolete, and its substitute's 5 V operation is unverified. And the Raspberry Pi 4 Model B 2 GB is $102.91 at the only authorized source checked, which dominates the bill of materials. None of this blocks the course: the Wio Terminal track and the CounterFit simulator path are unaffected.

Action required

Part Problem Recommended action
Seeed Wio Terminal Starter Kit (SKU 5006) No listing found for the bundle at any distributor or retailer this run Buy the constituent parts individually - all are listed below and sourceable
Seeed Raspberry Pi 4 Starter Kit (SKU 5004) No listing found for the bundle; searches returned Pi 5 and GrovePi+ kits instead Buy the constituent parts individually
Raspberry Pi Camera Module v2 (SC0023) Discontinued at DigiKey; 0 stock across ECIA distributors (Mouser out of stock, DigiKey 14-week lead time) Order the Seeed IMX219 module ($9.90) or buy the official module at retail ($15.00)
Seeed 6 V Mini Water Pump (SKU 1945) Both Seeed pumps at DigiKey are Obsolete with 0 stock Substitute DFRobot FIT0563 at $9.20, but read its datasheet first - 5 V operation is unverified
Seeed Grove LED Pack (SKU 4364) No distributor or retail listing for the pack Buy 2 x Grove Red LED modules ($2.10 each); they keep the LED socket and the brightness potentiometer
Raspberry Pi 4 Model B 2 GB $102.91 at the only authorized source found; largest single line item Check education/retail channels before ordering; the snapshot also permits Pi 2B/3B/3B+ for headless use
Grove Time of Flight Sensor (101020532) 0 stock at DigiKey Order from Mouser - 47 in stock at $10.63 (ECIA/TrustedParts)

Cybersecurity — software & network

Review before networking — The simulator students run locally is pinned to Flask and eventlet versions with known network-reachable flaws the project's own pins block upgrading, the lessons carry telemetry and actuator commands over unencrypted MQTT, and the whole firmware toolchain is unpinned and uncheckable.

Component Version How known Support status
CounterFit (virtual IoT hardware simulator) not determined unpinned (The curriculum links the CounterFit-IoT/CounterFit repository with no tag, commit or release; the repository's main branch was listed this run.) —
Flask (CounterFit web UI) 2.1.2 read from project (counterfit-app/setup.py install_requires pins "Flask==2.1.2") —
Flask-SocketIO (CounterFit browser/device channel) 5.2.0 read from project (counterfit-app/setup.py install_requires pins "Flask-SocketIO==5.2.0") —
eventlet (CounterFit WebSocket server) 0.33.3 read from project (counterfit-app/setup.py install_requires pins "eventlet==0.33.3") —
setuptools (CounterFit build/install) 65.5.0 inferred (counterfit-app/requirements.txt writes "setuptools =65.5.0" with a single '=', which pip does not read as a pin; the version was taken from that line) —
pytest (CounterFit test suite) 7.2.2 read from project (counterfit-app/setup.py tests_require lists 'pytest==7.2.2') —
black (CounterFit repository tooling) 23.1.0 inferred (repository-root requirements.txt writes "black =23.1.0" with a single '='; the version was taken from that line) —
azure-functions (soil-moisture cloud trigger) not determined unpinned (bare package name in soil_moisture_trigger_requirements.txt (snapshot)) —
azure-iot-hub (device management SDK) not determined unpinned (bare package name in soil_moisture_trigger_requirements.txt (snapshot)) —
Docsify / docsify-cli (offline documentation viewer) not determined unpinned (README.md tells the reader to run 'docsify serve' with no version constraint (snapshot)) —
PlatformIO Atmel SAM platform (atmelsam) not determined unpinned (wio_nightlight_platformio.ini declares 'platform = atmelsam' with no version (snapshot)) —
PlatformIO board target seeed_wio_terminal not determined unpinned (wio_nightlight_platformio.ini declares 'board = seeed_wio_terminal' with no version (snapshot)) —
Arduino Core for SAMD (Wio Terminal firmware framework) not determined unpinned (wio_nightlight_platformio.ini declares 'framework = arduino' with no version (snapshot)) —
Interactive quiz web app (ff-quizzes.netlify.app) not determined not determined (third-party hosted site linked from README.md; no version or source pin (snapshot)) —
Raspberry Pi OS / host operating system not determined not determined (no OS version or release codename is recorded in the snapshot) —
Component Finding Severity Fix available?
black (CounterFit repository tooling) black 23.1.0 is the code formatter listed for people who clone the CounterFit repository to work on it — it is not installed by students running the labs, and the critical item is an attack on the project's own GitHub formatting action rather than on anything in the classroom. — PYSEC-2026-2120, PYSEC-2026-2121, GHSA-fj7x-q9j7-g6q6 critical Yes — update to 26.3.1 or later, which matters only if staff clone the CounterFit repository for development.
Flask (CounterFit web UI) The simulator's web interface runs on Flask 2.1.2, which can omit the 'Vary: Cookie' header and let a shared cache or proxy hand one browser's session cookie to the next person. — GHSA-m2qf-hxjv-5gpq, GHSA-68rp-wp8r-4726 high No — project pins Flask==2.1.2 in counterfit-app/setup.py; mitigation only — run CounterFit on the student's own machine rather than on a shared or public network.
setuptools (CounterFit build/install) The setuptools version listed in the simulator's requirements (65.5.0) has arbitrary-file-write and command-injection flaws that fire while it downloads packages, so an install pointed at a hostile package index could run code on the student's machine. — GHSA-5rjg-fvgr-3xxf, GHSA-cx63-2mw6-8hw5, GHSA-r9hx-vwmv-q579, GHSA-h35f-9h28-mq5c high Yes — update to 78.1.1 or later; the requirements row is malformed ('setuptools =65.5.0'), so nothing in the project actually holds the old version in place.
eventlet (CounterFit WebSocket server) The network server the simulator listens on (eventlet 0.33.3) is affected by a denial-of-service issue and an HTTP request-smuggling issue; both need someone able to reach the simulator over the network. — GHSA-3rq5-2g8h-59hc, GHSA-hw6f-rjfj-j7j7 moderate No — project pins eventlet==0.33.3 in counterfit-app/setup.py; mitigation only — keep the simulator on localhost or an isolated lab network.
pytest (CounterFit test suite) pytest 7.2.2 is pulled in only when the simulator's own test suite is run; the flaw is in temporary-directory handling on a shared machine. — GHSA-6w46-j5rx-g56g moderate Yes — update to 9.0.3 or later; test tooling only, not part of a student install.
CounterFit (virtual IoT hardware simulator) Dependencies unpinned: 8 of 8 in counterfit-app/requirements.txt — every row is written with a single '=' ('flask =2.1.2'), which pip does not read as a version pin, so an install picks up whatever is current that day and its security state cannot be re-checked from the file. posture Mitigation only — pin versions / use the lockfile, and record the versions actually installed in the lab materials.
CounterFit (virtual IoT hardware simulator) The curriculum points students at the simulator's repository with no tag, release or commit, so every classroom install is whatever the project happened to publish that day. posture Mitigation only — install one named release, record it in the lab materials, and re-check it each term.
MQTT telemetry and actuator control Lessons stream sensor telemetry and actuator commands to MQTT brokers over unencrypted TCP port 1883, so anyone who can see that traffic can read the readings and the commands sent to the relay and pump. posture Mitigation only — use the broker's TLS port 8883 where it offers one, and keep lab devices on their own network segment.
Raspberry Pi remote access (SSH) The Raspberry Pi track sets the board up for headless access with SSH listening on port 22, and the lab materials do not record changing the Pi's account password, so that step is left entirely to the instructor. posture Mitigation only — set a non-default password or key-only login before the Pi joins any shared or campus network.

What this means for your lab

Most of this lab's software risk sits in one place: CounterFit, the simulator students run on their own PC, which serves a web page and a WebSocket connection from pinned older libraries. Someone else on the same network who can reach that simulator could disrupt it, and on a shared machine or through a shared proxy a session could leak between browsers; the project pins those library versions itself, so the practical answer is to run the simulator on the student's own machine and not expose it to the wider network. Separately, the MQTT lessons send sensor readings and actuator commands in the clear over port 1883, so anyone watching the network can read them and, on a public test broker, see what your devices are doing — use the TLS port where the broker offers one. The Raspberry Pi track turns on SSH for headless work and the materials never say to change the account password, so do that before the Pi touches a campus network. Nothing here suggests the lab is unsafe to teach; it does mean the devices and the simulator belong on an isolated lab network rather than on the main campus one, and it is worth raising with campus IT before connecting anything. The Arduino and PlatformIO firmware side could not be checked at all — those ecosystems have no vulnerability database, so treat 'no findings' there as 'unknown', not 'clean'.

Not checked

  • PlatformIO Atmel SAM platform (atmelsam): unpinned in wio_nightlight_platformio.ini, and PlatformIO platform packages have no vulnerability database
  • PlatformIO board target seeed_wio_terminal: unpinned board definition; no vulnerability database for board support packages
  • Arduino Core for SAMD: unpinned framework; Arduino cores and libraries have no advisory database, so absence of findings is not evidence of safety
  • azure-functions: listed without a version in soil_moisture_trigger_requirements.txt — no version exists to check
  • azure-iot-hub: listed without a version in soil_moisture_trigger_requirements.txt — no version exists to check
  • docsify-cli: README.md gives no version constraint — no version exists to check
  • Interactive quiz web app (ff-quizzes.netlify.app): third-party hosted web service with no version or source pin; nothing checkable
  • CounterFit application code itself: source-only project installed from the repository's main branch; no advisory database covers it, and no release is pinned
  • Raspberry Pi OS / host operating system: no OS version or release codename is recorded in the snapshot, so no support-status lookup was possible

Parts

Complete pre-packaged kits

Part Spec/Package Status Stock Price Source
Seeed Wio Terminal Starter Kit (SKU 5006) Boxed bundle: Wio Terminal, Grove modules, Arducam, ReSpeaker HAT not checked (no bundle listing found) — — —
Seeed Raspberry Pi 4 Starter Kit (SKU 5004) Boxed bundle: Pi 4, Grove Base Hat, Grove sensors not checked (no bundle listing found) — — —

Arduino track hardware (Wio Terminal platform)

Part Spec/Package Status Stock Price Source
Wio Terminal (Seeed 102991299) ATSAMD51P19A + RTL8720DN, 2.4in LCD, 5 V USB-C in, 3.3 V logic Active - readily available 453 $36.25 DigiKey
USB-C connection cable USB-C plug to host USB-A or USB-C, USB 2.0 data not checked (commodity) — — —
ArduCam Mini 2MP Plus OV2640 (B0067) 34 x 24 mm module, 8-pin 2.54 mm header, 3.3-5 V VCC available at retail; exact SKU unverified — $35.85 eBay (usa*stores); not carried by DigiKey
ReSpeaker 2-Mics Pi HAT (Seeed 107100001) Pi HAT 65 x 56 mm, WM8960 codec, I2S + I2C Active - readily available 1,197 $12.90 DigiKey
Breadboard jumper wire pack (Seeed SKU 234) 24-28 AWG Dupont, F-F and M-F ends no listing for the Seeed pack; commodity substitute available — $2.45-$4.95 PiShop USA / ZYLtech
Mono enclosed speaker 2 W 6 Ohm (Seeed SKU 2832) Enclosed speaker, 2-pin JST 2.0; or 3.5 mm headphones available at retail; rating unverified — $3.78 OpenELAB
MicroSD card, 16 GB maximum microSDHC Class 4/10, FAT16/FAT32; >16 GB will not mount readily available — $7.00-$14.95 eBay / Walmart / Best Buy

Raspberry Pi track hardware

Part Spec/Package Status Stock Price Source
Raspberry Pi 4 Model B 2 GB (SC0400DE) 85.09 x 55.88 mm SBC, 40-pin GPIO, 5 V USB-C at 3 A Active - available, price is the issue 133 $102.91 DigiKey
MicroSD card 16-32 GB (Pi track) Class 10 / UHS-I / A1 readily available — $7.00-$14.95 eBay / Walmart
Raspberry Pi USB-C power supply 5.1 V DC, 3.0 A minimum readily available — $7.99 Micro Center (also DigiKey at $8.00)
Grove Base Hat for Raspberry Pi (Seeed 103030275) Pi HAT, 15 Grove ports, STM32 ADC at I2C 0x04 Active - available, thin stock 109 $8.06 DigiKey
Raspberry Pi Camera Module v2 (SC0023) 25 x 24 mm, Sony IMX219 8 MP, 15-pin 1 mm FFC discontinued through authorized distribution 0 $15.00-$25.99 retail Seeed Studio / Newegg; substitute below
Pi audio input/output peripherals USB mic + speaker, USB headset, ReSpeaker HAT, or USB speakerphone ReSpeaker path available; USB options not checked 1,197 $12.90 DigiKey (ReSpeaker HAT)
Grove Light Sensor v1.2 (Seeed 101020132) Grove 4-pin, LS06-S phototransistor, analog out Active - readily available 173 $2.12 DigiKey
Grove Button (Seeed 101020003) Grove 4-pin, momentary tactile, active-high Active - readily available 619 $1.90 DigiKey

Shared sensors and actuators

Part Spec/Package Status Stock Price Source
Grove LED Pack (Seeed SKU 4364), qty 2 modules Grove 4-pin LED socket board with rotary brightness pot no listing for the pack; substitute below — — —
Grove Temperature and Humidity Sensor DHT11 (Seeed 101020011) Grove 4-pin, DHT11, single-wire digital Active - available, modest stock 67 $5.00 DigiKey (also Master Electronics, 98 at $6.39)
Grove Capacitive Moisture Sensor (Seeed 101020614) Corrosion-resistant probe, Grove 4-pin, analog out Active - readily available 436 $6.50 DigiKey
Grove Relay (Seeed 103020005) Grove 4-pin, 5 V coil, screw terminals, 250 VAC / 5 A Active - readily available 817 $2.90 DigiKey
Grove GPS Air530 (Seeed 109020022) Grove 4-pin, GNSS with patch antenna, 9600 baud NMEA Active - readily available 855 $11.00 DigiKey
Grove Time of Flight Distance Sensor VL53L0X (Seeed 101020532) Grove 4-pin, VL53L0X, I2C 0x29 Active at DigiKey but out of stock; in stock at Mouser 0 at DigiKey / 47 at Mouser $9.086 at DigiKey, $10.63 at Mouser DigiKey / ECIA

Optional automated plant watering hardware

Part Spec/Package Status Stock Price Source
Seeed 6 V Mini Water Pump (SKU 1945) Mini DC immersible pump, 3.5-6.0 V, 200-500 mA obsolete - both Seeed pumps at DigiKey are Obsolete, 0 stock 0 $6.90 (obsolete listing) DigiKey; substitute below
Adafruit USB terminal block breakout (3628) USB-A male plug to 5-pin terminal block, 5 mm pitch, 26-16 AWG available (stock not stated on the page) — $4.95 Adafruit
Flexible silicone tubing, 4-6 mm ID Aquarium/food-grade tubing, 0.5-1 m not checked (non-electrical commodity) — — —
Hookup wire, red and black 22-26 AWG Stranded copper, 2 x 15-30 cm not checked (commodity) — — —
Precision flat-head screwdriver 1.5-2.5 mm slotted tip not checked (hand tool) — — —

Virtual simulation fallback and physical supplies

Part Spec/Package Status Stock Price Source
Virtual host system peripherals Workstation with webcam, microphone, speakers not checked — — —
Non-technical agricultural supplies Potted plant with soil; fresh and bruised produce not checked (bought locally) — — —

Substitutes

For part Substitute Differences Verified Judgment
Raspberry Pi Camera Module v2 (SC0023, discontinued) Seeed 114992267, $9.90, Active, 30 in stock (alt: 114992266, $12.90, 160-degree lens) Same Sony IMX219 8 MP sensor the snapshot names, same "RPi V2 camera" module class per the distributor record; 77-degree lens vs the official module's lens - a framing difference in the vision lessons, not a compatibility one; cheaper than the retail official part Verified: sensor (IMX219 8 MP) and module class from the DigiKey record, status/stock/price from DigiKey, second-source corroboration from ECIA. Not verified: the 15-pin 1 mm FFC connector and PCB footprint (no parameters block returned), and lens field of view vs the official module Acceptable - the curriculum's camera code targets the IMX219 sensor
Grove LED Pack (SKU 4364, no listing) Seeed 104030005 "Grove Red LED", $2.10, Active, 915 in stock - buy 2 Keeps both things the lab needs: a plug-in LED holder (so the pack's assorted 5 mm LEDs still fit) and the onboard rotary potentiometer students adjust for brightness; Grove 4-pin connector as before Verified: onboard brightness potentiometer and plug-in LED holder (Seeed wiki page fetched this run), Grove module identity, lifecycle, stock and price (DigiKey). Not verified: numeric supply-voltage range - the wiki says only "higher range of input voltages" and no parameters block was returned Acceptable - the snapshot explicitly allows any Grove digital LED socket module
Seeed 6 V Mini Water Pump (SKU 1945, obsolete) DFRobot FIT0563, $9.20, Active, 126 in stock Same class of part (miniature immersible DC pump) and same 6 V nominal rating; the snapshot allows any 5-6 V DC mini submersible pump run from a 5 V USB rail, but the lab drives this one from 5 V through the Grove relay, so it must actually run at 5 V Verified: part class, 6 V nominal rating, lifecycle, stock and price (DigiKey record). Not verified: the operating voltage range - whether it runs at the lab's 5 V rail - and its current draw; DigiKey returned no parameters block and the DFRobot product page could not be fetched Plausible, unverified - read the datasheet for 5 V operation before ordering
Breadboard jumper wire pack (Seeed SKU 234, no listing) Retail Dupont ribbon sets: F-F 40-pin $2.95, M-F 40-pin $4.95 Same Dupont 2.54 mm terminations in the female-to-female and male-to-female mixes the ReSpeaker-to-Wio wiring needs; sold as ribbon sets rather than an assorted-length pack Verified: nothing beyond the listing titles, which state the F-F and M-F Dupont ends. Not verified: wire gauge against the snapshot's 24-28 AWG range - the listings do not state it and the pages were not fetched Plausible, unverified - low risk, but confirm the gauge with the seller
Mono enclosed speaker 2 W 6 Ohm (SKU 2832, no distributor listing) Retail "Seeed Studio Mono Enclosed Speaker", $3.78; or any 3.5 mm headphones Listing title matches the product name; the snapshot also accepts any standard 3.5 mm analog headphones, which sidesteps the question entirely Verified: nothing beyond the listing title matching the product name. Not verified: the 2 W / 6 Ohm rating and the 2-pin JST-PH 2.0 connector - the product page was not fetched Plausible, unverified - the headphone path makes this low-risk either way

Verify any substitute against its datasheet before ordering - the "not verified" notes above are the specific claims this check could not confirm from evidence.

Other dependencies

  • Custom fabrication: none required. The snapshot confirms there are no Gerber files, ODB++ archives or custom CAD layouts - every board in the lab is a commercial off-the-shelf product connected with Grove cables, Dupont jumpers or 40-pin stacking headers.
  • Seeed Studio product pages (12 URLs) - not usable as status evidence this run. Every one of them returned the same 6,462-character export-compliance boilerplate instead of product data; seeedstudio.com is JavaScript-rendered and the fetcher sees only the wrapper. The URLs resolve, but no price or stock could be read from them, which is why the Seeed parts above are priced from DigiKey and shopping results instead.
  • arducam.com and raspberrypi.com product pages - not fetched. Both refused the request (blocked or timed out), so the ArduCam and Raspberry Pi vendor pages are not on the record.
  • Adafruit product page (adafruit.com/product/3628) - live and readable, with current price breaks and a distributor list.
  • Community links (Microsoft Foundry Discord invite, Microsoft Foundry developer forum) - not checked; not load-bearing for running the lab.

Watch list

  • Raspberry Pi Camera Module v2 - already gone from authorized distribution with a 14-week factory lead time; expect the retail listings to thin out next, and plan on the IMX219 substitute becoming the default path.
  • 16 GB microSD cards - the Wio Terminal bootloader hard-caps at 16 GB, so this line cannot follow the market up to 32 GB and larger. Small cards are still sold, but they are the part most likely to quietly disappear.
  • Grove Base Hat (103030275) - only 109 units at the distributor checked, and the lab cannot substitute it: grove.py addresses this board's STM32 ADC registers directly. A class of 20+ should order early.
  • Grove Time of Flight sensor (101020532) - already at zero at DigiKey and carried by one other distributor with 47 units; the next check should confirm it has not gone the way of the pump.
  • Grove DHT11 (101020011) - 67 units at DigiKey and 98 at the second source; thin for a full class ordering at once.
  • Seeed starter-kit bundles (5006 and 5004) - the curriculum's recommended purchase route did not turn up for sale anywhere this run. If Seeed has retired them, the lab's shopping instructions need rewriting even though every constituent part is still available.
  • Raspberry Pi 4 2 GB pricing - $102.91 through authorized distribution makes the Pi track roughly twice the cost of the Wio track; worth re-pricing each term.