Readiness: WeeWX Weather Station

Verdict: Ready with caveats · 2026-09-03 · est. parts cost $135–$1,765 Cybersecurity — software & network: Review before networking

This is the cold check for this lab — there is no previous report, so everything below is the baseline the next check will measure drift against. Every item on the bill of materials is sourceable today from a live seller, and nothing is discontinued in a way that stops the lab running. Three things keep it off a clean "Ready". The cost swings by more than a factor of ten depending on which weather station console you buy ($100 to $1,730 in the prices found this run), so it is easy to budget badly. The Davis bundles actually on sale ship with a "WeatherLink Console", and WeeWX's own supported-hardware page requires a serial, USB, or WeatherLinkIP interface — no page read this run says which interface those bundles expose, so console compatibility is unconfirmed. And the cheap Ecowitt alternative is priced but the gateway model inside the kit was not confirmed against WeeWX's supported list. None of these is a sourcing failure; all three are "confirm before you order" items. Note also that this lab has no PCB, schematic, or component-level parts list — the bill of materials is five whole-unit purchases, so no footprint or supply-rail checks apply anywhere in this report.

Action required

Cybersecurity — software & network

Review before networking — WeeWX 5.5.0 itself is clean and opens no inbound port, but the committed lockfile pins library versions carrying critical advisories, every dependency is declared unpinned, and the documented upload paths include cleartext FTP and MQTT.

What this means for your lab

WeeWX itself came back clean this run: version 5.5.0 has no known published vulnerabilities, and the project's documentation describes no inbound network port opened by the weather daemon, so someone else on the campus network cannot simply connect to it and take it over. The risks are quieter than that. If you install from the project's source repository using its committed lockfile, you get library versions that are several years old — the image library in particular has flaws serious enough that a malformed image file could run code on the Raspberry Pi, and the database library has one that could let crafted data reach a MySQL database as commands; installing with pip, or updating those libraries afterwards, avoids this, and nothing in the project prevents the upgrade. The lab's report-publishing options also include plain FTP and unencrypted MQTT, which put the username and password on the network in readable form for anyone sharing it, so prefer rsync over SSH or FTPS and MQTT over TLS. Finally, this check could not examine the weather station console or gateway at all — that is a network-connected device in its own right. Treat both it and the Pi as untrusted equipment: put them on a segmented or guest network rather than the main campus LAN, change any default password the console ships with, and check with campus IT before connecting anything permanently.

Not checked

• cryptography, poetry, pytest, zensical (dev group): Declared with no version constraint in pyproject.toml and absent from poetry.lock, so there is no exact version to check.
• poetry-core (build backend): Declared as a minimum bound (>=2.0.0) only and not present in the lockfile, so there is no exact version to check.
• SQLite: No version stated in the project files or the snapshot; it ships with whichever Python the host runs, which was not determined.
• MySQL server: Optional external database; no version stated in the project files or the snapshot.
• InfluxDB: Optional external database; no version stated in the project files or the snapshot.
• Host operating system as actually installed: Unpinned — the instructor chooses it. Bookworm was assumed from the snapshot's check plan; a different OS or release has a different support status.
• Weather station console and gateway firmware: Not recorded in the snapshot's software section, and no public advisory database covers consumer weather-station firmware — absence of advisories here is not evidence of safety.
• WeeWX source modules (weecfg, weectllib, weedb, weeimport, weeplot, weeutil, weewx, weewx_data): The snapshot notes the src directory was omitted from the uploaded files, so the lab's own code was not available to inspect.

Parts

Notes on the table. The $35.00 Raspberry Pi listing is titled only "Raspberry Pi 4 Model B" and does not state its RAM tier, so treat it as the floor of the family rather than a confirmed 2GB/4GB price; a confirmed 4GB kit is $61.05. A "CM4104000 Raspberry Pi CM4 4GB" result at $144.00 also came back — that is a Compute Module 4, a different form factor needing a carrier board, and is not the Model B this lab calls for. The manufacturer's own product page could not be read this run (the site blocked the fetch), so no claim is made here about the Pi 4B's remaining production life. For the interface cable, DigiKey's description reads "CABLE USB RS232 PREMIUM 1M DB9" and returned no parametric detail, so the DB9 connector gender is not verified — the snapshot asks for a female DB9, and you must match the cable to your console's port before ordering. Cheaper retail cables exist ($9.99 Sabrent, $20.99 Valley Enterprises) but most do not state a chipset in the listing, which the snapshot requires.

Substitutes

Verify any substitute against its datasheet — and, for a weather console, against WeeWX's supported-hardware list — before ordering.

Other dependencies

• Fabrication: none applicable. The lab has no PCBs, Gerbers, schematics, or mechanical manufacturing files. Physical fabrication is limited to commodity mounting hardware — mast clamps, U-bolts, solar radiation shields, tripod mounts. Not checked: the snapshot gives no sourcing plan for these and no lookup was dispatched.
• https://www.weewx.com/hardware.html — live. Fetched successfully this run (3,202 characters of supported-hardware tables). This is the page to check a console against before buying; it lists roughly 30 supported station families including AcuRite, Fine Offset/Ecowitt, LaCrosse, Oregon Scientific, Peet Bros, RainWise, Hideki, Texas Weather Instruments, Vaisala and WeatherFlow.
• https://www.raspberrypi.com/products/raspberry-pi-4-model-b/ — fetch failed. The page could not be downloaded this run (blocked, timeout, or gone). The site most likely blocks automated fetches; this is not evidence the page is gone, but the manufacturer's price tiers and production commitments are not on the record.
• Not checked: the remaining external sites the lab links — weewx.com homepage, /docs/ and /docs/quickstarts.html, /downloads, hwcmp.html, showcase.html and stations.html, the GitHub repository and its issue tracker and wiki, and the weewx-user Google Group. No lookups were dispatched for them. The GitHub repository was reachable at the v5.5.0 tag during this run, which is indirect evidence that that URL is live.

Watch list

• DS9490R# (1-Wire adapter) — the bare DS9490R catalogue entry is already Obsolete. The packaging variant is Active with healthy stock today, but this is a single-source, end-of-life-adjacent part on one distributor; check its lifecycle status first at the next run.
• Davis Vantage Pro2 interface — the unresolved question of which bundles expose a serial, USB, or WeatherLinkIP interface is the most likely thing to strand a purchase. Worth resolving from a Davis product page next run rather than leaving it to the instructor.
• Ecowitt gateway model — the low-cost route hinges on a gateway model that WeeWX's page does not name. If the Ecowitt line moves on from the GW1000 family, the cheap path to this lab closes; re-check the supported-hardware page against current Ecowitt SKUs.
• Raspberry Pi 4 Model B — the Pi 5 is the current flagship and the 4B's remaining production life could not be established this run. Price spread is already wide ($35.00 to $165.00). Watch for the 4B thinning out; the snapshot's high substitution latitude (any Pi or x86_64 PC) means this is a price-and-convenience risk, not a blocker.
• Weather console prices generally — this lab's cost is dominated by one purchase that ranged $99.75 to $1,730.00 this run. Drift here matters far more to an instructor's budget than any other line.