The Raspberry Pi in a homelab is a learning tool. The Raspberry Pi in a production rack, behind the firewall, plugged into a switch, running a real workload on the same network as the payment system, is an unmanaged device running unpatched firmware with a default password and an open SSH port. The Pi does not have an IPMI. The Pi does not have a vendor that will patch your firmware on a schedule. The Pi does not even have a coherent story about what firmware version it is running. Most production Pis in 2026 were deployed by a developer who needed a quick fix, were never documented, and have been running quietly in a corner of the rack ever since. They are now a security incident waiting to happen.
What the actual problem is
Three problems stacked. The first is inventory. Most organisations cannot answer the question “how many Raspberry Pis do we have, and where are they” with any confidence. The Pi is small, cheap, and easy to deploy. It does not show up in the standard endpoint management tooling. It does not run the corporate EDR. It does not appear in Active Directory. It exists in a grey zone between IT, OT, and the developer who deployed it. The second problem is patching. The Pi does not have a managed OS update path. apt get update and apt get upgrade work, but they require someone to log in and run them, and most production Pis have not been logged into in months. The third problem is the supply chain of the Pi itself. The Raspberry Pi Foundation has had firmware and bootloader issues over the years. The Pi 5 shipped with a known EEPROM bug that allowed unauthenticated boot configuration changes in early 2024. The bug was patched. Most Pis in production have not been updated.
The result of these three problems is a fleet of devices that are unmanaged, unpatched, and in the production network. The attacker who finds one has a foothold on a device that no one is monitoring, that no one is patching, and that can reach whatever the network allows. The data exfiltration pattern is the same as for any unmanaged IoT: a small device, on a quiet network, with a constant connection out. The Pi is a particularly good version of this because it has real compute, real storage, and a Linux userspace the attacker can use as a beachhead.
What to actually do
Inventory first. Walk the racks. Look behind the servers. The Pis are usually near the network gear, on top of a switch, or behind a monitor that no one is using. The Pi cases are distinctive. Count them. The second move is network segmentation. The Pis should not be on the same VLAN as the production systems. They should be on a management VLAN, with explicit rules about what they can and cannot reach. The third move is to remove the Pi from production entirely. The Pi in a homelab is fine. The Pi in a development environment is fine. The Pi in production, doing a job that a small industrial PC could do more reliably and with proper management, is a liability. Replace the Pi with a managed device. The cost is roughly 5x the Pi, and the security improvement is roughly 100x.
If replacing the Pi is not an option, the next best is to put it behind a bastion. Disable password auth on the Pi. Disable root login. Force key based SSH. Lock down the firewall. Disable every service the Pi does not need. Update the firmware. Update the OS. Update the installed packages. Do this on a schedule, and audit it. The Pi can be made reasonable. The Pi cannot be made invisible. The audit has to happen.
The bottom line
Inventory, segment, replace or bastion. The Pi in production is a liability today. The fix is operational, not technical. Walk the racks. Find the Pis. Move them off the production VLAN, or off the production network entirely.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
