Readiness report
RTKBase GNSS RTK Base Station · 2026-09-03 15:58 · complete · 26 searches, 6 pages fetched
Cybersecurity — software & network: Do not place on an open network · 15 findings
Details in the Cybersecurity section of the report below.
Readiness: RTKBase GNSS RTK Base Station
Verdict: Ready with caveats · 2026-09-03 · est. parts cost $577–$732 (one base station; the Septentrio mosaic-X5 option adds roughly $450) Cybersecurity — software & network: Do not place on an open network
This is the cold check — the first readiness report for this lab, so it establishes the baseline every future check measures drift against. Every functional block of the base station can be sourced today from evidence gathered this run. Four things keep it off a clean "Ready": the PoE splitter in the BOM (TRENDnet TPE-104GS) is Obsolete with 30 pieces left at one distributor and no ECIA-authorized distributor carrying it; the host Raspberry Pi 3 Model B+ is Not For New Designs (though 14,996 are on the shelf, and the snapshot's equally acceptable Pi 3 Model B is Active); the snapshot's representative RF-cable part number turns out to be a BNC-to-BNC 6-inch jumper rather than the SMA-to-TNC outdoor run the lab needs, and it is out of stock everywhere; and the DA910 antenna could not be found at retail under that model name. Verified, in-stock substitutes were found for all three of the last group, so nothing here blocks a build.
Action required
| Part | Problem | Recommended action |
|---|---|---|
| TRENDnet TPE-104GS (PoE splitter) | Obsolete at DigiKey, 30 pieces left; no ECIA-authorized distributor lists it at all. Its rated 2 A at 5 V is also below the lab's own ≥ 2.4 A criterion. | Switch to Tycon POE-SPLT-BT-UNI-P ($69.25, 381 in stock). Feed it from the BOM's 802.3at PoE+ injector, not a plain 802.3af midspan, and replace the barrel-to-micro-USB adapter with a bare-wire-to-micro-USB lead — its DC output is a wire terminal block. |
| Amphenol 115101-09-06.00 (antenna RF cable) | The representative part number is a BNC-to-BNC 6-inch jumper — wrong connectors, wrong length — and every ECIA distributor shows 0 stock. | Order Siretta ASMZG500A058L13 (SMA male to TNC male, 16.4 ft / 5 m, $50.55, 70 in stock). |
| DA910 GNSS antenna | No retail listing found under that model name this run. | Order the SparkFun SPK6618H multi-band surveying antenna ($179.69, 255 in stock) — TNC female, L1/L2/L5, 5/8"-11 survey mount. Confirm LNA gain and bias voltage on its datasheet. |
| SanDisk SDSQQNR-032G-GN6IA (microSD) | DigiKey returns no product; the exact part number sells at $127.63 — about five times the going rate. | Buy any high-endurance Class 10 / U1 card of 16 GB or more, as the lab's own notes allow: SanDisk High Endurance, $22.99. |
| Raspberry Pi 3 Model B+ (SC0073) | Not For New Designs; RS quotes a 364-day factory lead time and ECIA rates supply-chain risk High. | Safe to buy today — 14,996 in stock at $40.00 — but plan the next build around SC0022 (Pi 3 Model B, $35.00) or an Orange Pi Zero, both documented in the lab. |
Cybersecurity — software & network
Do not place on an open network — The web control panel ships with a documented default password over plain HTTP, the documentation adds an unauthenticated serial-over-TCP listener, and 10 of the 41 pinned Python packages carry published advisories - four of them high severity in the web-facing stack.
| Component | Version | How known | Support status |
|---|---|---|---|
| RTKBase (web app + services) | 2.7.0 | read from project (settings.conf.default line 5 'version=2.7.0' (fetched/02-settings.conf.default)) | — |
| RTKLIB-EX (rtklibexplorer RTKLIB, str2str) | v2.5.0 | read from project (tools/install.sh line 204 downloads tags/v2.5.0.tar.gz (fetched/04-install.sh); note README line 96 still documents 2.4.3b34j) | — |
| Debian GNU/Linux | 12 | inferred (README line 339 requires 'Debian base distro >= 12 (Bookworms)' - a floor, not a pin; 12 taken as the floor) | extended/LTS support only until 2028-06-30 |
| Python 3 | 3.11 | inferred (README line 340 requires 'Python >= 3.11' - a floor, not a pin; 3.11 taken as the floor) | supported until 2027-10-31 |
| Armbian_RTKBase SBC image | not determined | unpinned (the documented image URL github.com/Stefal/build/releases/latest always resolves to the newest release) | — |
| pi-gen RTKBase image | not determined | unpinned (the documented image URL github.com/jancelin/pi-gen/releases/latest always resolves to the newest release) | — |
| gpsd | not determined | unpinned (README line 202 asks for 'a gpsd release >= 3.2'; installed via apt with no version pin) | — |
| click | 8.1.8 | read from project (web_app/requirements.txt (fetched/01-requirements.txt)) | — |
| Flask | 3.1.2 | read from project (web_app/requirements.txt (fetched/01-requirements.txt)) | — |
| idna | 3.10 | read from project (web_app/requirements.txt (fetched/01-requirements.txt)) | — |
| lxml | 6.0.1 | read from project (web_app/requirements.txt (fetched/01-requirements.txt)) | — |
| python-engineio | 4.12.2 | read from project (web_app/requirements.txt (fetched/01-requirements.txt)) | — |
| python-socketio | 5.13.0 | read from project (web_app/requirements.txt (fetched/01-requirements.txt)) | — |
| requests | 2.32.5 | read from project (web_app/requirements.txt (fetched/01-requirements.txt)) | — |
| setuptools | 80.9.0 | read from project (web_app/requirements.txt (fetched/01-requirements.txt)) | — |
| urllib3 | 2.5.0 | read from project (web_app/requirements.txt (fetched/01-requirements.txt)) | — |
| Werkzeug | 3.1.3 | read from project (web_app/requirements.txt (fetched/01-requirements.txt)) | — |
| Component | Finding | Severity | Fix available? |
|---|---|---|---|
| click | Click's edit() helper passes arbitrary OS commands through; this only bites if RTKBase actually calls click.edit(), which the evidence does not establish either way. — PYSEC-2026-2132 | high | Yes - update to 8.3.3 in web_app/requirements.txt |
| lxml | lxml's default parser settings allow XML external entity attacks, so XML the base station parses could be used to read local files off the SBC. — GHSA-vfmq-68hx-4jfw | high | Yes - update to 6.1.0 in web_app/requirements.txt |
| python-engineio | The websocket transport under the web GUI allocates threads without bound and does not always enforce its maximum payload size, so anyone who can reach port 80 can knock the interface over. — GHSA-cgwc-pv48-fhj5, GHSA-m9gh-vj53-gvh9 | high | Yes - update to 4.13.2 in web_app/requirements.txt |
| python-socketio | The same live-update layer accumulates binary attachments until memory runs out, and in multi-server deployments can be made to execute arbitrary Python through a malicious pickle - both reachable from the web GUI's port. — GHSA-5w7q-77mv-v69f, GHSA-g8c6-8fjj-2r4m | high | Yes - update to 5.16.2 in web_app/requirements.txt |
| urllib3 | The HTTP library behind the base station's outbound requests mishandles compressed responses and cross-origin redirects, so a hostile or compromised server it fetches from (map tiles, update checks) can exhaust the SBC's memory or have sensitive headers forwarded to it. — GHSA-38jv-5279-wg99, GHSA-qccp-gfcp-xxvc, GHSA-2xpw-w6gg-jr37, GHSA-gm62-xv2j-4w53 | high | Yes - update to 2.7.0 in web_app/requirements.txt |
| idna | Crafted domain names can slip past idna.encode()'s validation, which matters where the base station resolves a hostname supplied to it (for example an NTRIP caster address). — GHSA-65pc-fj4g-8rjx | moderate | Yes - update to 3.15 in web_app/requirements.txt |
| requests | The requests library reuses a predictable temporary file in extract_zipped_paths(), which a local account on the SBC could abuse. — GHSA-gc5v-m9x4-r6x2 | moderate | Yes - update to 2.33.0 in web_app/requirements.txt |
| setuptools | A packaging flaw that lets files escape MANIFEST.in exclusions on macOS filesystems; it does not affect a running Debian base station, but the pinned version is behind. — GHSA-h35f-9h28-mq5c | moderate | Yes - update to 83.0.0 in web_app/requirements.txt |
| Werkzeug | Werkzeug's safe_join() can be tricked by Windows special device names; the base station runs on Debian, so the practical exposure here is low. — GHSA-29vq-49wr-vm6x, GHSA-87hc-h4r5-73f7, GHSA-hgf8-39gv-g3f2 | moderate | Yes - update to 3.1.6 in web_app/requirements.txt |
| Flask | Flask omits the 'Vary: Cookie' header in some cases, which can cause a cache in front of the GUI to serve one session's page to another viewer. — GHSA-68rp-wp8r-4726 | low | Yes - update to 3.1.3 in web_app/requirements.txt |
| Debian GNU/Linux 12 | Debian 12's standard security support ended 2026-07-11; the release now gets patches only from the LTS/extended stream (until 2028-06-30), so fixes arrive on a slower, narrower track. | posture | Mitigation only - target a release still in standard support for new builds; the lab requires only 'Debian >= 12'. |
| Local NTRIP caster (str2str_local_ntrip_caster, TCP 2101) | The shipped configuration leaves local_ntripc_user and local_ntripc_pwd empty, so the local NTRIP caster has no credentials set out of the box. | posture | Mitigation only - set local_ntripc_user and local_ntripc_pwd before enabling the local caster. |
| RTKBase installer (tools/install.sh) | The installer pulls code that the pinned requirements file does not cover: 'pip install nmcli' and 'pip install git+https://github.com/Stefal/sim-modem.git' (a git URL with no tag or commit), plus 'pip install --upgrade pip setuptools wheel', all served through the third-party piwheels index. | posture | Mitigation only - pin these installs to versions or commits and review the sources before running install.sh. |
| RTKBase web interface | The web GUI ships with the published default password 'admin' and its default PBKDF2 hash baked into settings.conf.default, and it is served over plain HTTP on port 80, so anyone who can reach the base station can log in and change its settings until that password is changed. | posture | Mitigation only - change the web password at first boot; there is no TLS option, so keep the device off open networks. |
| socat receiver bridge (documented optional step) | The documentation tells operators to expose the GNSS receiver's serial port with 'sudo socat tcp-listen:128,reuseaddr /dev/ttyS1,b115200,raw,echo=0', an unauthenticated TCP listener on port 128 that lets anyone on the network drive the receiver directly. | posture | Mitigation only - bind the listener to localhost or reach it through an SSH tunnel, and stop it as soon as the configuration session ends. |
What this means for your lab
This base station is meant to sit on a network and hand out correction data, and out of the box it is not safe to expose. Its web control panel answers on the ordinary web port with the password 'admin', which is printed in the project's own documentation, and the connection is plain HTTP, so anyone who can reach the device on your campus network can log in, change the base coordinates, read its data, or redirect where it streams to - and anyone watching the network can read the password as you type it. The optional 'socat' diagnostic step in the instructions opens a second door with no password at all, straight onto the GNSS receiver. On top of that, all 41 of the Python packages the web application pins were checked this run and 10 of them have published security bugs, including several in the very components that serve the web page and its live updates; 31 came back clean. What to do: change the web password before the device ever touches a network, put it on an isolated segment or VLAN of its own (not the campus wireless), leave the socat bridge off except while you are actively configuring the receiver, update the listed Python packages, and talk to campus IT before connecting it - a device that publishes its own location and accepts remote configuration is exactly the sort of thing they want to know about.
Not checked
- Armbian_RTKBase SBC image: unpinned - the documented URL always resolves to the latest GitHub release, so there is no version to check
- pi-gen RTKBase image: unpinned - the documented URL always resolves to the latest GitHub release, so there is no version to check
- RTKLIB-EX v2.5.0 (str2str, rtkrcv, convbin): compiled from a GitHub source tag; no vulnerability database covers it, so this is 'not examined', not 'clean'
- 18 apt system packages (git, build-essential, pps-tools, python3-pip, python3-dev, python3-setuptools, python3-wheel, libsystemd-dev, bc, dos2unix, socat, zip, unzip, pkg-config, psmisc, avahi-daemon, chrony, gpsd): installed with 'apt install -y' and no version pins; the version is whatever the OS ships, so there is nothing fixed to look up
- gpsd: the project asks for '>= 3.2', a range rather than a pin, and installs it from apt
- pip, setuptools, wheel (installer bootstrap): installed with 'pip install --upgrade', so the version is whatever is current at install time
- sim-modem: installed from 'git+https://github.com/Stefal/sim-modem.git' with no tag or commit pin and no registry release to look up
Parts
| Part | Spec/Package | Status | Stock | Price | Source |
|---|---|---|---|---|---|
| GentleBOX JE-200 enclosure | Outdoor weatherproof box with cable glands | readily available | — | $19.15 | Retail — Jirous GB-JE-200 |
| Raspberry Pi 3 Model B+ — SC0073 | SBC 1.4 GHz 4-core 1 GB, 85.09 × 55.88 mm | Not For New Designs | 14,996 | $40.00 | DigiKey |
| Orange Pi Zero (512 MB) — alternative SBC | Ultra-compact SBC, 48 × 46 mm, 26-pin header | readily available | — | $24.97 | Retail (Orange Pi Zero LTS 512 MB listed at $31.49) |
| u-blox ZED-F9P receiver, breakout board | Carrier board with USB, SMA, PPS/UART header | readily available at board level | 319 | $275.00 | DigiKey — SparkFun GPS-15136, the carrier the lab names. Bare module also Active: ZED-F9P-04B $127.42, stock 6,136. Drotek's own board and the Ardusimple simpleRTK2B were not priced this run. |
| Septentrio mosaic-X5 — alternative receiver | Breakout / dev board, USB + IP interface | available, high cost | 19 | $649.95 | DigiKey — SparkFun GPS-28766. Bare module 410546, $625.00, stock 3,214. |
| Unicore UM980 / UM982 — alternative receiver | Carrier breakout, USB/UART, SMA | readily available | — | $201.92 | Retail (listings from $150.00 to $213.80) |
| DA910 multi-band GNSS antenna | Survey dome, TNC female, active LNA 3–12 V | not found this run | — | — | No DA910 listing returned; see Substitutes |
| Antenna RF cable — Amphenol 115101-09-06.00 | Snapshot needs SMA male to TNC male, 1–5 m, 50 Ω | wrong spec (BNC to BNC, 6 in) and 0 distributor stock | 0 | $24.81 | DigiKey; all five ECIA distributors out of stock. See Substitutes |
| TRENDnet TPE-115GI PoE+ injector | 802.3at midspan, 100–240 V AC in | available, single source | 40 | $34.00 | DigiKey (listed by VEC Supply); no ECIA distributor carries it |
| TRENDnet TPE-104GS PoE splitter | Gigabit splitter, 5 V/9 V/12 V selectable, 2 A | Obsolete | 30 | $25.00 | DigiKey; no ECIA distributor carries it. See Substitutes |
| DC barrel-to-micro-USB adapter cable | 5.5 × 2.1 mm female barrel to micro-USB male | readily available | — | $5.99 | Retail, from $1.90; the ≥ 2.5 A rating is not stated in any listing |
| PPS timing / ground jumper wires | 2.54 mm female-to-female DuPont, 2 conductors | readily available | — | $1.80 | Retail — 40-piece pack, 20 cm |
| USB interconnect cable — Tensility 10-00648 | USB 2.0 A to micro-USB, short assembly | readily available | 123 | $3.51 | DigiKey |
| Ethernet cable — L-com TRD855SCR-10 | Cat5e shielded RJ45-RJ45, 10 ft | available; not stated outdoor-rated | 83 (Heilind) | $36.39 | DigiKey; ECIA: Heilind 83 @ $42.86, ICC 16, Mouser 546 on order @ $33.36 |
| MicroSD card — SanDisk SDSQQNR-032G-GN6IA | Class 10 / UHS-I, ≥ 16 GB | exact part number badly overpriced | — | $127.63 | Retail; DigiKey returns no product. See Substitutes |
Substitutes
| For part | Substitute | Differences | Verified | Judgment |
|---|---|---|---|---|
| Raspberry Pi 3 Model B+ (SC0073, NFND) | SC0022 — Pi 3 Model B, $35.00, stock 18,155 | Slower CPU (1.2 GHz vs 1.4 GHz 4-core, same 1 GB RAM) and 10/100 rather than the B+'s faster Ethernet — neither matters for one RTCM stream. Board outline 85.60 × 56.50 mm vs 85.09 × 55.88 mm: same mechanical class, both inside the lab's 85 × 56 mm figure. The lab names "Raspberry Pi 3 Model B (or Model B+)" as its reference build. | Verified: board dimensions, CPU/RAM class, lifecycle and stock (DigiKey parametrics). Not verified: that DigiKey's order code SC0022 carries the exact "Model B" marketing name; GPIO 18 PPS pin assignment on the substitute. | Acceptable — the lab's own alternative primary, Active and plentiful. |
| TRENDnet TPE-104GS (Obsolete) | Tycon POE-SPLT-BT-UNI-P, $69.25, stock 381 | Input 802.3af/at/bt, 44–57 V — meets the lab's 36–57 V. Selectable 5 V/9 V/12 V/24 V output — meets the 5 V rail. 14 A / 90 W output vs the original's 2 A — exceeds the ≥ 2.4 A requirement. Power budget: on 802.3af the device gives only 12 W total, below the Pi 3 B+ 12.5 W peak, so it must run off the BOM's 802.3at injector (24 W). DC output is a wire terminal block, not a barrel jack — the barrel-to-micro-USB adapter no longer mates. Larger: 119.4 × 86.4 × 27.9 mm DIN-rail housing vs 83.8 × 63.5 × 22.1 mm. Wider temperature range (−40 to +75 °C vs 0 to +40 °C) — exceeds. | Verified: 802.3af/at/bt input, selectable 5 V output and the af/at power budget (manufacturer product page fetched this run); input range, output voltages, output current, temperature and dimensions (DigiKey parametrics). Not verified: that the 5 V rail sustains 2.4 A while the pass-through PoE port is also loaded; mechanical fit inside the JE-200. | Acceptable with two caveats — pair with the 802.3at injector, and check enclosure space. |
| DA910 antenna (not found) | SparkFun SPK6618H — DigiKey 21801, $179.69, stock 255 | Bands L1/L2/L5/E6 across GPS, GLONASS, Galileo, BeiDou — meets and exceeds the lab's L1/L2 requirement. TNC female connector — matches, so the same SMA-to-TNC cable applies. 5/8"-11 TPI survey thread — matches the lab's threaded bottom mount. NGS-certified (SFESPK6618H). | Verified: connector type and gender, band and constellation coverage, mount thread (SparkFun product page fetched this run); frequency ranges 1.15–1.278 GHz and 1.55–1.61 GHz, lifecycle, price, stock (DigiKey). Not verified: the ≥ 28 dB LNA gain and the 3.0–12.0 V bias range — neither figure appears in the parametrics or the fetched page. | Acceptable, pending a datasheet check of gain and bias voltage. |
| Amphenol 115101-09-06.00 (wrong spec, no stock) | Siretta ASMZG500A058L13, $50.55, stock 70 | SMA male to TNC male, both free-hanging in-line — matches the receiver's SMA female and the antenna's TNC female. 16.4 ft (5 m), the top of the lab's 1–5 m range. Frequency to 6 GHz vs the required ≥ 1.6 GHz — exceeds. | Verified: both connector genders, mounting style, maximum frequency and length (DigiKey parametrics and description); lifecycle, price, stock (DigiKey). Not verified: 50 Ω characteristic impedance and the outdoor/UV rating — neither is in this part's parametrics. | Acceptable for the RF path; weatherproof the antenna-end connection and confirm impedance on the datasheet. Rejected on the evidence: RF Solutions CBA-TNCF-SMAM / -SMAMR (TNC female bulkhead, 7.8 in — wrong gender and length) and McGill RG223-SF-TM (SMA female — wrong gender at the receiver). |
| SanDisk SDSQQNR-032G-GN6IA (overpriced) | SanDisk High Endurance, $22.99 or SanDisk Max Endurance 32 GB SDSQQVR-032G, $37.11 | Same family, same 32 GB capacity class; the lab allows any high-endurance Class 10 / U1 card of 16 GB or more. | Verified: nothing beyond listing titles and prices — these are retail search results and no product page was fetched. Not verified: endurance class, capacity and speed grade of the specific listings. | Plausible, unverified — buy from a reputable seller and check the card's endurance rating on the packaging. |
Verify any substitute against its datasheet before ordering.
Other dependencies
- Fabrication: none. The build is entirely commercial off-the-shelf — no PCB, Gerber, drill or board CAD files. The only mechanical work is drilling the GentleBOX JE-200 baseplate to mount the SBC and the receiver carrier.
- github.com/Stefal/rtkbase — the installer script and release tarball the lab downloads from. Reachable: files at tag v2.7.0 were fetched successfully this run.
- github.com/rtklibexplorer/RTKLIB — the source archive the installer pulls. Referenced by the fetched installer, but the archive itself was not downloaded — not checked.
- MapTiler Cloud (maptiler.com) — optional aerial map tiles in the GUI, needs a registered API key — not checked.
- OpenStreetMap tile servers — the GUI's default map tile provider — not checked.
- caster.centipede.fr:2101 — the default upstream NTRIP caster the base station streams to — not checked.
Watch list
- TRENDnet TPE-104GS — obsolete with 30 pieces at a single distributor and no authorized channel behind it; expect this to be gone by the next check. The Tycon substitute is the durable answer.
- TRENDnet TPE-115GI — 40 pieces at one distributor, no ECIA coverage. Not a problem yet (any 802.3at midspan will do), but the exact part is one order away from unavailable.
- Raspberry Pi 3 Model B+ (SC0073) — Not For New Designs, 364-day factory lead time at RS, supply-chain risk rated High. Today's 14,996 pieces are the tail of the run.
- u-blox ZED-F9P-02B — already Not For New Designs; the -04B, -05B and -15B variants are the ones to buy.
- DA910 antenna — no retail presence found at all; treat it as gone unless the instructor knows a vendor.
- SanDisk SDSQQNR-032G-GN6IA — no distributor stock and a five-times-market asking price; the exact part number is effectively obsolete even though equivalent cards are cheap.