(
diff)
← Older revision | Approved revision (diff) | Latest revision (diff) | Newer revision → (diff)
| Raspberry Pi Pico W (SC0918)
|
|
Security Grade
Calculator v1
|
Raspberry Pi Pico W (SC0918)
Release Date: 2022-06-30 • Status:
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
P: Physical programming exposure is documented; malicious tampering frequency is unknown. Rare is a provisional midpoint, not a measured incident rate.
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
I: Unauthenticated HTTP is a weakness of this reference application. Rare is a qualitative provisional mapping, not a model-specific CVE count.
|
| Prior attacks
|
Rare
|
🔗 Proof
|
P: Historical attack frequency is unknown. The linked design source is not an incident census; 2 is only an illustrative midpoint.
|
| Updatability
|
Very common
|
🔗 Proof
|
I: Manual reprogramming is documented. The low update-risk point reflects that capability, not automatic patching or a guaranteed support lifetime.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
No
|
🔗 Proof
|
C: No application peer authentication.
|
| Communications
|
No encryption
|
🔗 Proof
|
C: HTTP lacks end-to-end TLS; Wi-Fi protection is separate.
|
| Storage
|
No encryption
|
🔗 Proof
|
C: Selected scenario leaves application storage unencrypted. This is a deployment assumption, not absence of silicon cryptography.
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Absent
|
🔗 Proof
|
C: No application accounts.
|
| Authentication
|
Absent
|
🔗 Proof
|
C: No HTTP login check.
|
| Brute-force protection
|
Absent
|
🔗 Proof
|
C: No application authentication gate or login throttling.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
I: Console request diagnostics; no complete access audit.
|
| Passwords
|
Default/Common/Easy to guess
|
🔗 Proof
|
I: No application password; closest weakest option. Not a claim about the Wi-Fi key.
|
| Category Score
|
Score: 3 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
MicroPython v1.29.0 reference build; installed version not observed (Companion App: )
|
| Hardware (CPU / GPU)
|
CPU: RP2040 • GPU:
|
| Memory & Storage
|
Memory: • Storage: 2 MB external flash
|
| Power, Battery & Charging
|
Battery: • Power: • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: Wi-Fi; HTTP reference application; USB programming
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
Assessment scope — 2026-10-24: application-specific, provisional. Manufacturer MicroPython HTTP LED-control example; GP15 output. The scored application is the documented example, not factory firmware.
Software scope: MicroPython v1.29.0 reference build; installed version not observed. No physical device, installed firmware, production revision or working build was inspected. Example sources are reviewed as retrieved on the assessment date; they are not immutable version pins.
Conditions: configured Wi-Fi access; a client can reach the HTTP endpoint; no added reverse proxy, application authentication, storage encryption or cloud service. These are explicit paper-assessment conditions, not claims about factory defaults or every possible deployment.
Rubric limitations: E=documented, I=interpretation, C=conditional, P=provisional. D1 and D3 incident rates remain unknown; the chosen Rare labels are midpoint scenarios, not verified frequency findings. D2 maps a reference-program weakness, not a hardware CVE. U5 maps no application password to the weakest available option.
Calculation: ceil((2+2+2+1)/4)+ceil((3+3+3)/3)+ceil((3+3+3+2+3)/5)=2+3+3=8 (D, provisional). Allowing D1/D2/D3 to vary over 1–3 yields 7–9 (C–F), keeping the stated application assumptions. No unconditional product grade is established.
Release date: 2022-06-30. Manufacturer launch and availability date; regional import availability was staggered. No claim of simultaneous worldwide availability. Official availability announcement.
Model-specific boundary: SC0918 is the unpopulated-header Pico W, distinct from the non-wireless Pico and the later Pico WH. USB programming access is relevant to physical exposure, not evidence of actual malicious tampering. Manufacturer model record.
Practical improvement: add authenticated TLS access, protect secrets and physical access, and maintain the selected firmware. Reassess after any change. Reference source.
