QNAP TS-473A (TS-473A-8G)

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	[[1] 🔗 Proof]	Physical reset restores the admin account and a device-label-derived password. Rare is a qualitative physical-access risk rating, not a measured tampering rate.
Known vulnerabilities	Rare	[[2] 🔗 Proof]	Historical CVE-2024-6387 affected QTS 5.2.0 RC; vendor lists a fixed 20240711 build. This does not establish vulnerability in the assessed 5.2.8 baseline.
Prior attacks	Rare	[[3] 🔗 Proof]	Vendor confirms 2022 DeadBolt attacks through exposed, vulnerable Photo Station on QNAP NAS. This is legacy platform history, not proof that a TS-473A or this baseline was compromised.
Updatability	Very common	[[4] [5] 🔗 Proof]	QTS provides automatic critical/quality updates and manual updating. TS-473A is explicitly listed for QTS 5.2.8.3332; Very common describes documented update provision, not a measured cadence.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	[[6] 🔗 Proof]	LDAP integration uses bind credentials with optional TLS. Partial is a conservative service-dependent mapping; universal mutual authentication across every interface is not established.
Communications	Encrypted with up-to-date encryption	[[7] 🔗 Proof]	Assessed administration profile forces HTTPS with TLS 1.2 or newer and strong ciphers. This does not mean every optional file-transfer service is encrypted by default.
Storage	No encryption	[[8] [9] 🔗 Proof]	QuLog requires an unencrypted volume for its local access-log database. This conservative rating concerns that store; separate user-data volumes support AES-256 encryption.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Full	[[10] [11] [12] 🔗 Proof]	QTS supports local users, per-folder/app permissions, password changes, account disabling and deletion of non-default users. Full describes documented account-management capabilities.
Authentication	Secure	[[13] 🔗 Proof]	Assessed profile enforces password plus TOTP 2-step verification for interactive QTS users. Physical-reset recovery remains a separate risk; MFA is not claimed for every protocol.
Brute-force protection	Exist	[[14] 🔗 Proof]	IP Access Protection blocks client addresses after configurable failed-login thresholds and time windows. Protection is assumed enabled for the assessed login methods.
Event logging	Access event logged	[[15] [16] 🔗 Proof]	QuLog supports local access logs by user and source IP. The profile enables relevant connection-type logging and configures a log destination and retention.
Passwords	Require change after setup with complexity requirements	[[17] [18] 🔗 Proof]	Configured profile requires password change at first logon and enforces a length/character policy. These are configurable controls, not a claim of universal default enforcement.
Category Score	Score: 1 / 3

Technical Specifications

Property	Details
Operating System & App	QTS (assessment baseline: 5.2.8.3332) (Companion App: )
Hardware (CPU / GPU)	CPU: AMD Ryzen Embedded V1500B; 4 cores/8 threads, 2.2 GHz • GPU:
Memory & Storage	Memory: 8 GB SODIMM DDR4; expandable to 64 GB • Storage: 5 GB flash; 4 SATA drive bays; 2 M.2 NVMe slots (SSDs not included)
Power, Battery & Charging	Battery: • Power: 250 W PSU; 100–240 V AC, 50–60 Hz • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: 2 × 2.5GbE RJ45; 3 × USB Type-A 10Gbps; 1 × USB Type-C 5Gbps
Physical (Dimensions & Mass)	Dimensions: 180.2 × 199.3 × 279.6 mm (H × W × D; excluding foot pads) • Mass: 5.54 kg (net)

Documentation-based assessment of QNAP TS-473A-8G using model-compatible QTS 5.2.8.3332 build 20251128; no physical device or firmware was tested. This is a configured profile: forced HTTPS/TLS with strong ciphers, password plus TOTP for interactive QTS login, IP Access Protection, least-privilege accounts, first-login password change and enforced complexity, and configured access logging. These settings are not asserted to be universal defaults. Communication encryption is scoped to administration, not every optional service. Storage is conservatively rated No encryption for the local QuLog access-log database: QTS requires an unencrypted log-destination volume, even though separate user-data volumes support AES-256. No whole-flash encryption is claimed. Historical QTS RC vulnerabilities and DeadBolt attacks on legacy Photo Station deployments are not proof of a vulnerable assessed build or a compromised individual TS-473A. None/Rare/Very common are qualitative mappings, not measured incident rates. Release date follows the manufacturer's 2021-05-24 availability announcement. Hardware values follow the current model specification, excluding foot pads. Unverified optional fields, including current sales status, are left blank.