Vape-to-Web Server: Tiny MCU Runs HTTP on a Discarded E-Cig

An engineer has turned a discarded disposable vape into a functioning web server — and the stunt is more than a neat hack: it’s a concise demonstration of how tiny, low-cost microcontrollers embedded in throwaway consumer goods can be repurposed to run real network stacks and serve pages, while also exposing practical, environmental, and security questions about the millions of such devices being discarded every week.

Overview​

Bogdan Ionescu — known online as BogdanTheGeek — disassembled a disposable vape pen, identified the on-board microcontroller, re-flashed and reworked its firmware, and used the device’s USB connection to present a classic SLIP-based network interface to a host machine. He then ran the compact uIP 0.9 TCP/IP stack on the chip and hosted a simple HTTP page directly from the vape’s flash memory. The demonstration reduces modern cloud infrastructure to its barest components: a small microcontroller, a few kilobytes of RAM, and a tiny web stack serving content to a caller on the network.
The raw hardware involved is modest: the chip family he pulled from the board belongs to the PY32 series and, in the particular part he reprogrammed, behaves like a Cortex‑M0+ microcontroller running at up to 24 MHz with roughly 24 KB of flash and about 3 KB of SRAM. Those numbers are tiny by modern standards, but are consistent with the processor families being embedded into low-cost consumer devices and — as Ionescu’s work shows — they are still capable of meaningful networked functionality when coupled with very small-footprint network stacks.

---

Background: disposable electronics and the hidden compute inside​

Why vapes contain microcontrollers​

Modern disposable e-cigarettes have evolved from single-function heating elements into compact consumer gadgets. To control power, monitor puff counts, display battery status, and manage USB charging, device makers increasingly use small 32‑bit MCUs rather than single-purpose analog controllers. Those MCUs provide minimal but full microcontroller capabilities — CPU, flash, SRAM and a set of peripherals (UART, I²C, SPI, ADC, timers).
Key hardware characteristics revealed in this case:

• ARM Cortex‑M0+ core at up to 24 MHz.
• ~24 KB of flash storage and ~3 KB of SRAM in many PY32 series parts.
• On‑board USB charge controllers and test points that often provide access to programming interfaces.

These specs are validated by the PY32 family documentation and chip vendor materials, which list similar core frequency and memory figures. The presence of a reprogrammable PY32 variant is consistent with numerous community reverse‑engineering reports showing PUYA/PY32 devices embedded in e-cigarette PCBs.

The e‑waste scale​

This hack sits within a wider context: disposable vapes generate substantial waste streams. Academic and institutional studies have shown that millions of units are thrown away weekly in some markets, and that their lithium-ion cells are frequently still capable of many hundreds of charge cycles. That combination — cheap compute, reflashable microcontrollers, and abundant discarded hardware — creates both an opportunity for creative reuse and a headache for environmental management.

---

How the hack works: from vape to server​

Hardware identification and preparation​

Ionescu started by carefully opening a disposable vape and identifying the main controller IC. The package marking initially read like a vendor code (PUYA C642F15), but cross‑referencing vendor documentation and community reverse‑engineering activity points to the processor family commonly sold under the PY32/PUYA label. The chip family’s datasheets list the small memory and clock specs quoted above.
Access to the chip’s I/O and to its USB charge interface made it possible to communicate with the IC without wholesale desoldering equipment: many boards expose test pads and USB lines that can be used for serial or SWD programming.

Networking trick: SLIP over USB serial​

Microcontrollers of this class rarely have full Ethernet MACs or Wi‑Fi radios, but most provide serial interfaces. The Serial Line Internet Protocol (SLIP) is an old, byte‑stream protocol that wraps IP packets over a serial link. By implementing SLIP on the MCU side and connecting the MCU’s serial endpoint to a host using the USB‑serial interface, the device can behave like a low‑speed network interface.
On the host side, utilities such as slattach (or equivalent) and socat can attach the serial device as a network link — the host then assigns an IP and routes packets to and from the device. This is effectively an emulated 56K dial‑up link, adequate for running basic TCP/IP services.

Software stack: uIP 0.9​

To keep memory and code footprint minimal, Ionescu used uIP 0.9, a compact TCP/IP stack originally designed for very small embedded systems. uIP has a tiny event loop model and example HTTP server code; it’s well suited to running on microcontrollers with kilobytes of RAM.
Key software steps included:

• Implementing a SLIP interface and a serial endpoint on the MCU.
• Building a trimmed-down uIP implementation and embedding a simple HTTP server front-end.
• Storing the webpage (a small HTML payload) in the remaining flash space and mapping HTTP requests to that data.
• Optimizing I/O buffering and batching writes to overcome initial throughput issues.

Optimizations and limits​

Initial performance was laughably poor: high ping latency and excessively long page loads. That’s common when a naive byte-by-byte serial implementation is used with a small event loop and no buffering. The meaningful speed improvement came from adding a ring buffer and batching writes, which reduced per-packet overhead and allowed the microcontroller to service the link more smoothly. After those changes, ping RTTs were reported to fall from ~1.5 seconds to ~20 milliseconds and a basic page could load in around 160 ms under limited load.
However, the constrained memory model and single-threaded, event‑driven design of uIP mean the device cannot sustain high concurrent request counts or large payloads. The web server is demonstrative, not production-grade.

---

What this proves: technical value and limitations​

Strengths of the demonstration​

• Resource economy: The build shows that with highly optimized software, very little hardware can host a functioning TCP/IP stack and HTTP service.
• Reusability of discarded hardware: Chips and batteries in disposable devices are often still viable for tinkering and low-power projects.
• Demonstrates classic embedded networking: Using SLIP and uIP highlights decades-old network engineering techniques that still have educational and practical value in constrained environments.
• Open-source sharing: Publishing firmware and build instructions helps the maker community learn and iterate, and it encourages responsible reuse rather than needless scrapping.

Technical and practical limitations​

• Tiny memory footprint: 24 KB of flash and 3 KB of SRAM impose hard limits on what can be served and how many simultaneous connections can be handled.
• Performance fragility: The server must rely on a host to attach the serial network and on careful buffering; small changes in traffic patterns can cause overloads.
• Storage endurance: Flash in mass-produced consumer electronics is often not specified for frequent reprogramming and can have limited erase/write cycles.
• Power constraints: While the internal lithium cell can power the board for a time, running a device continuously as a server or connecting it to arbitrary networks raises safety and battery life concerns.

---

Environmental and policy implications​

Reuse as an immediate win​

Repurposing components from disposable electronics is a straightforward way to extract additional value and reduce waste. Microcontrollers that would have been landfilled can serve in educational kits, sensors, or low-power controllers. The fact that the lithium cells inside some single‑use vapes can be recharged hundreds of times underscores the inefficiency of current “disposable” models.

Systemic problems remain​

Scaling reuse is nontrivial. Even if hobbyists salvage a fraction of discarded devices, the sheer volume of single‑use units being sold and discarded creates persistent environmental risk: toxic metals, solvents, and lithium can leach into waterways or cause fires at recycling facilities. The mitigation requires industry design changes (rechargeable, repairable devices), effective takeback schemes, and regulatory pressure — not just maker ingenuity.

Regulatory and market moves​

Some jurisdictions are moving to restrict or ban single‑use products, or to introduce producer-responsibility requirements. Those policy shifts aim to reduce the inflow of disposable electronics and to force manufacturers into designing for reuse or safe recycling.

---

Security, safety, and ethical considerations​

Security risks​

• Exposure if connected to public networks: An ad‑hoc device hosting a network stack can become an entry point for attackers. Tiny stacks like uIP were not designed with modern threat models in mind; they may lack hardened TCP/IP implementation details, secure default configurations, or protection against malformed packets.
• Firmware supply chain: Using code from unknown sources and reprogramming unknown silicon can introduce malware or backdoors if caution is not exercised.
• Misuse potential: The same techniques that demo a cute “vape web server” could be used to hide network-capable devices inside innocuous consumer waste — a plausible concern for secure facilities.

Physical and chemical safety​

• Battery hazards: Harvesting lithium cells from damaged or corroded disposables carries fire and chemical risks. Cells can be shorted, punctured, or have degraded protection circuits.
• Contaminants: Vapes may contain residual e‑liquid, which can be sticky, toxic, and messy. Proper cleaning and PPE are essential.

Ethical dimensions​

• Handling drug‑related devices: Some discarded devices may contain traces of controlled substances or be associated with underage use; collectors should consider legal and ethical boundaries when salvaging items.
• Waste substitution: There’s a fine line between encouraging reuse and normalizing scavenging as a substitute for producer responsibility. Reuse is valuable, but it should complement — not excuse — better product design and recycling infrastructure.

---

What makers and hobbyists should know before experimenting​

If the demonstration inspires similar projects, keep these practical rules in mind:

• Safety first
• Never short or crush lithium cells. Use proper battery handling equipment and clean, ventilated work areas.
• Remove contaminated components carefully and neutralize e‑liquid residues before soldering.
• Work offline
• Test and develop on isolated networks or a separate LAN. Don’t expose an experimental device directly to the public Internet.
• Use host-side tools such as slattach, socat, and controlled routing to safely bridge the device to a testbed.
• Protect firmware
• Audit any third‑party code before flashing. Keep build environments reproducible and sign firmware images if possible.
• Consider programming lock bits and write protections to reduce accidental overwriting or tampering.
• Respect legal constraints
• Dispose of hazardous waste properly. Reused parts that remain dangerous should be turned over to licensed recyclers.
• Document and share responsibly
• Publishing code and write-ups helps the community, but avoid posting instructions that make unsafe battery or network practices easier for novices.

---

Broader technical lessons for embedded and IoT communities​

• Tiny stacks still matter: uIP and similar micro stacks fill a persistent niche: where memory is scarce, compact event-driven stacks remain useful and teachable.
• Serial networking is a powerful tool: SLIP and PPP remain relevant for bridging tiny devices to modern networks without bulky radios or Ethernet controllers.
• Commodity consumer devices are fertile ground for reuse: The economics that drive disposable product design also put low-cost compute into the market at scale. That compute is technically capable, but often locked behind non‑trivial reverse engineering and safety barriers.
• Design for repair and reuse would change the game: If manufacturers embraced reprogrammable modules, exposed standardized programming headers, and improved battery recyclability, the maker community could do far more positive work at scale.

---

Risks to watch at scale​

• E-waste externalities: Individual hacks don’t reduce the macro problem of millions of disposable devices being dumped weekly. Robust policy interventions and producer responsibility are required.
• Embedded security threats: If inexpensive microcontrollers can host network services, adversaries could embed small malicious endpoints into mass‑produced devices or discard them into environments to create stealthy implants.
• Public safety incidents: Widespread scavenging of batteries without controls risks fires and injuries, and could overload informal reuse channels with unsafe cells.

---

Conclusion​

The vape-to-webserver project is a tidy, technically grounded demonstration: with a 24 MHz Cortex‑M0+ and a few kilobytes of memory, a convincingly functional web server can be built — if you accept stringent limits and do careful software engineering. The stunt is valuable because it highlights three converging trends: the surprising compute capacity embedded in throwaway devices, the longevity of the lithium cells packed into those devices, and the continuing relevance of tiny TCP/IP stacks and serial networking techniques.
Beyond the novelty, the work is a reminder that hardware is never merely hardware: design choices — about program‑ability, battery chemistry, and recyclability — have consequences across environmental, safety, and security domains. Repurposing discarded electronics is laudable and instructive, but it’s not a substitute for systemic change. Greater responsibility from manufacturers, clearer takeback schemes, and safer device design would let those seconds lives for chips and batteries scale up from hobbyist projects into genuine circular‑economy wins while reducing risk to the people and infrastructure that handle our waste.

---

Source: theregister.com Engineer turned a vape into a web server