Readiness: SimpleEVSE-WiFi Charger Retrofit

Verdict: Ready with caveats · 2026-09-03 · est. parts cost €90 + $19 (minimum ESP8266 build) to about €415 (fully optioned 2.0 build) Cybersecurity — software & network: Do not place on an open network

This is the cold check for this lab — there is no previous report, so everything below is the baseline the next check will measure drift against. Every item in the bill of materials has a current, priced, in-stock source found this run, and the two boards the lab cannot run without — the EVSE charge controller and, on the 2.0 path, the EVSE-WiFi 2.0 Base — are both stocked by the original vendor at 2–5 business days. Three things keep this off a clean "Ready". The plain "EVSE WB" and "EVSE DIN" controllers the lab names are no longer sold; the vendor now offers only the "EVSE WBDIN Ladecontroller mit RS485", preconfigured for EVSE-WiFi 2.0, and its shipped firmware revision is not stated anywhere, so the lab's hard requirement (revision 8 or ≥ 10, with revision 9 explicitly unsupported) cannot be confirmed before ordering. The vendor's main domain has moved — evse-wifi.de now redirects to smartwb.de — and the firmware download page the lab's own README points at is dead, while the newest GitHub release carries no binaries, so the documented "flash.bat plus compiled binary" route is broken and the firmware must be built from source. Finally, upstream is stale: the last release is from January 2021 and the last commit from January 2023. None of this blocks the build, but an instructor should resolve the controller question with the vendor before spending money.

Action required

Cybersecurity — software & network

Do not place on an open network — A network service that switches a mains EV charging contactor accepts unauthenticated commands, ships with a documented default password and an open setup access point, and upstream has been unmaintained since 2021 with no fix available.

What this means for your lab

Treat this charger controller as an untrusted device on your network. Its web interface starts with a password that is printed in the project's public documentation ('adminadmin'), and on first boot it broadcasts its own open Wi-Fi network called 'evse-wifi' that anyone nearby can join without a password. More importantly, its HTTP interface accepts commands without asking who is sending them: anyone who can reach the device on the network can start or stop a charging session, change how much current the charger delivers, reboot it, or download the log of which RFID card charged when. Because this controls a mains-powered EV charging contactor, that is a safety matter as well as a privacy one. The project has had no release since January 2021, so do not expect fixes. Before you connect it to anything, change the web password, put the device on its own isolated network segment or VLAN with no path from the general campus or student network, and talk to campus IT first. One thing we could not tell you: none of the firmware libraries this project uses have a vulnerability database covering them, so we cannot say whether they contain known flaws - that is unknown, not clean.

Not checked

• plerup/EspSoftwareSerial 6.9.0: OSV has no 'platformio' ecosystem - the lookup returned unknown_ecosystem, so nothing was queried. This is not the same as 'no vulnerabilities'.
• espressif32 3.0.0: Not queryable: OSV has no 'platformio' ecosystem, and endoflife.date has no 'espressif32' product, so neither advisories nor support status could be checked.
• espressif8266 (PlatformIO platform): Unpinned - no version exists to check, and PlatformIO platforms have no advisory database.
• miguelbalboa/MFRC522, bblanchon/ArduinoJson, emelianov/modbus-esp8266: Unpinned in platformio.ini, and Arduino/PlatformIO libraries have no vulnerability database in OSV.
• ESP8266 Core for Arduino: The README gives a minimum (>= 2.4.0), not an exact version, and endoflife.date has no 'esp8266' product - support status unknown.
• CurtRod/ModbusMaster (mandatory fork): Source-hosted git fork tracked at master - no registry and no version, so it cannot be checked against any advisory database.
• ESPAsyncWebServer, ESPAsyncTCP, ESPAsyncUDP, NTPClientLib, TimeLib, ESP8266Ping: All unpinned and installed from GitHub source - no registry version and no advisory database for these ecosystems.
• Arduino IDE and PlatformIO Core toolchains: No version is stated in any fetched file, so neither could be looked up.
• Precompiled firmware binaries and flash.bat: The vendor download page did not respond when fetched, so the binaries themselves could not be retrieved or examined.
• espressif32 3.0.0: support status: endoflife.date has no such product
• esp8266 2.4.0: support status: endoflife.date has no such product

Parts

Substitutes

Verify any substitute against its own datasheet before ordering — the comparisons above rest only on the evidence gathered this run.

Other dependencies

• https://www.evse-wifi.de/ — moved. The domain now redirects to https://www.smartwb.de/, which is live and was fetched this run; it sells the smartWB 11 kW Individual and Classic wallboxes and states that EVSE-WiFi is the open-source software running in each. The shop remains reachable at its own subdomain, shop.evse-wifi.de, which is where every vendor price in this report came from.
• https://www.evse-wifi.de/download/ — dead. Fetching it returned nothing this run. This is the page the lab's README and every GitHub release note point at for compiled firmware and the Windows flash.bat flasher. Building from source with PlatformIO is the way forward; the repository and its build configuration are intact.
• github.com/CurtRod/SimpleEVSE-WiFi — live but stale. The releases page was fetched: the newest release is v1.1.0 and it attaches no binary assets, only a pointer to the dead download page. The repository is not archived; its last commit is from January 2023.
• https://github.com/CurtRod/ModbusMaster — not checked this run. The lab flags this fork as mandatory (the upstream library triggers an ESP watchdog reset on Modbus timeout), so its availability should be confirmed at the next check.
• https://github.com/esp8266/arduino-esp8266fs-plugin — not checked this run.
• Custom PCB / fabrication — none required. The lab records no layout files; the build is off-the-shelf modules wired point-to-point, so there is nothing to fabricate or source.
• Vendor board-support files (base_1_045 board definition, default_8MB.csv partition table) — not in the repository. They are referenced by the build configuration but shipped only with the vendor hardware, so buying the EVSE-WiFi 2.0 Base module is the supported route for the ESP32 variant.

Watch list

• The EVSE charge controller. The exact products the lab names are already gone, and the surviving variant is being steered toward EVSE-WiFi 2.0. If the vendor drops the standalone controller, or stops exposing TTL UART, the v1.x ESP8266 half of this lab loses its foundation. Confirm the firmware revision on first order and record it as the new baseline.
• The vendor's web presence. One domain move and one dead download page in a single check is a lot of movement. Re-check shop.evse-wifi.de next run; if the shop follows the main site onto smartwb.de, every vendor URL in this report changes.
• The firmware distribution channel. With no binaries on GitHub and the vendor page gone, source builds are the only route. If the repository's dependencies drift out from under the unpinned lib_deps entries, builds may start failing outright — the single pinned library, EspSoftwareSerial 6.9.0, is the exception, not the rule.
• The Eastron meters. Neither DigiKey nor any ECIA-authorized distributor carries them, so pricing depends on the vendor shop and general retail. That is a thinner supply base than the rest of the BOM and worth watching for price movement.
• The RFID module's regular-size variant is already marked unavailable at the vendor, with only the mini version in stock — a small signal that this peripheral line is thinning.