Readiness report
OpenPLC Soft-PLC on Raspberry Pi · 2026-09-03 01:17 · complete · 12 searches, 0 pages fetched, est. $0.19
Cybersecurity — software & network: Do not place on an open network · 2 findings
Details in the Cybersecurity section of the report below.
Readiness: OpenPLC Soft-PLC on Raspberry Pi
Verdict: Ready · 2026-09-03 · est. parts cost $47–$113 Cybersecurity — software & network: Do not place on an open network
This cold check establishes the sourcing baseline and unit pricing for future drift measurement. Sourcing for all hardware bill of materials components is unblocked: the core Raspberry Pi single-board computers, official 5 V / 3 A power supplies, and optional USB CDC-ACM microcontroller peripherals are active, available at normal market pricing, and in deep stock across authorized distributors.
Action required
None — all checked parts are sourceable.
Cybersecurity — software & network
Do not place on an open network — OpenPLC Runtime v3 is an end-of-life platform running a network-facing web interface with a high-severity vulnerability pinned against updates.
| Component | Version | How known | Support status |
|---|---|---|---|
| OpenPLC Runtime version 3 | not determined | unpinned (git clone command in installation instructions has no tag or commit) | — |
| OpenPLC Editor | not determined | not determined | — |
| Linux Mint | 21 | inferred (Docker setup documentation in snapshot) | supported until 2027-04-30 |
| Raspberry Pi OS | not determined | not determined | — |
| Flask | 1.0.2 | inferred (requirements.txt stated in snapshot) | — |
| Flask-Login | 0.4.1 | inferred (requirements.txt stated in snapshot) | — |
| pyserial | 3.4 | inferred (requirements.txt stated in snapshot) | — |
| pymodbus | 2.2.0 | inferred (requirements.txt stated in snapshot) | — |
| background_installer.sh | not determined | not determined | — |
| EtherNet/IP and EtherCAT subsystems | not determined | not determined | — |
| Component | Finding | Severity | Fix available? |
|---|---|---|---|
| Flask | Flask 1.0.2 fails to set the Vary: Cookie header, allowing cached responses to leak session cookies to unauthorized users. — GHSA-M2QF-HXJV-5GPQ, CVE-2023-30861, GHSA-68RP-WP8R-4726, CVE-2026-27205 | high | No — project pins ==1.0.2 |
| OpenPLC Runtime version 3 | OpenPLC Runtime version 3 has reached end of life and is no longer maintained upstream. | posture | No — requires platform migration |
What this means for your lab
Anyone on the same local network can connect to the OpenPLC web management interface and industrial protocol ports. Because the underlying web server software has unfixable session security flaws and the entire OpenPLC Runtime v3 project is officially discontinued by its authors, these services cannot be safely updated in place. Furthermore, default login credentials and background build tools were not documented in the project files. Keep this device completely disconnected from shared campus networks, run it strictly on an isolated private lab network or standalone switch, and raise the setup with campus IT before use.
Not checked
- OpenPLC Runtime version 3: Vendor git repository is at end of life and has no package ecosystem database.
- OpenPLC Editor: Version not stated and no package ecosystem database.
- background_installer.sh: File missing from upload; background toolchain dependencies are unpinned and could not be determined.
- EtherNet/IP and EtherCAT subsystems: Implementation source and versions not stated.
- Raspberry Pi OS and other host distributions: Versions not stated and unpinned in setup scripts.
Parts
| Part | Spec/Package | Status | Stock | Price | Source |
|---|---|---|---|---|---|
| Host Single-Board Computer | Raspberry Pi 4 Model B 4GB (SC0194(9)), 40-pin GPIO, 5 V DC, 3.3 V LVTTL | Active | 12,270 | $100.00 | DigiKey |
| DC Power Supply for Host Platform | Raspberry Pi 15.3W USB-C Power Supply (SC0218), 5.1 V DC, 3 A output | Active | 4,499 | $6.75 | Newark |
| Serial Communication Peripheral (Optional) | Raspberry Pi Pico RP2040 (SC0915), USB CDC-ACM serial emulation | Active | 43,665 | $4.59 | DigiKey |
Substitutes
| For part | Substitute | Differences | Verified | Judgment |
|---|---|---|---|---|
| Raspberry Pi 3 Model B+ (SC0073) | Raspberry Pi 4 Model B 4GB (SC0194(9)) | Dimensions: 85.00 mm x 56.00 mm vs 85.09 mm x 55.88 mm; power input uses USB-C (≥ 3.0 A recommended) instead of micro-USB (≥ 2.5 A); compute/memory of 1.5 GHz 4-core with 4 GB RAM exceeds 1.4 GHz with 1 GB RAM; shares identical 40-pin GPIO pinout and 3.3 V LVTTL logic rail. | verified: package form factor and dimensions (DigiKey parametrics: 85.00 mm x 56.00 mm vs 85.09 mm x 55.88 mm), 40-pin GPIO layout and 3.3 V logic levels (snapshot platform specification), 5 V DC supply voltage rail; noted difference: USB-C connector replaces micro-USB connector. | Acceptable superior replacement. |
Instructors should verify any substitute against its datasheet before ordering.
Other dependencies
- Upstream OpenPLC Runtime v3 Git Repository (
https://github.com/thiagoralves/OpenPLC_v3.git): not checked. - Upstream OpenPLC Runtime v4 Git Repository (
https://github.com/autonomy-logic/openplc-runtime): not checked. - OpenPLC Editor Documentation & Download Portal (
https://openplcproject.com/docs/installing-openplc-editor/): not checked. - Docker CE Ubuntu Installation Documentation (
https://docs.docker.com/install/linux/docker-ce/ubuntu/): not checked. - Docker Compose Linux Mint 21 Installation Guide (
https://computingforgeeks.com/install-docker-docker-compose-on-linux-mint/): not checked. - Fabrication / Custom PCBs: None required. All hardware consists of commercial off-the-shelf single-board computers and peripheral modules.
Watch list
- Raspberry Pi 3 Model B+ (SC0073): Marked "Not For New Designs" by the manufacturer with zero stock at Mouser and a 16-week lead time, although DigiKey retains remaining stock. Labs should deploy Raspberry Pi 4 Model B (SC0194(9)) or newer hardware.
- Raspberry Pi 15.3W USB-C Power Supply (SC0218): Out of stock at DigiKey with a 30-week factory lead time, though currently well-stocked at Newark and Mouser. Monitor distributor stock before ordering.