(
diff)
← Older revision | Approved revision (diff) | Latest revision (diff) | Newer revision → (diff)
| QNAP TS-453Be (TS-453Be-4G)
|
|
Security Grade
Calculator v1
|
QNAP TS-453Be 4-bay NAS (TS-453Be-4G)
Release Date: 2018-02-14 • Status: End of life
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
Original research documents booting external media and changing this model's eMMC boot files to run another OS. This is a documented physical-access modification, not a remote attack. Rare is a qualitative mapping of a specific published example. Actual incident prevalence is unknown.
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
QTS has multiple documented vulnerabilities, including five CVEs in QSA-25-51 and the historical HBS flaw exploited by Qlocker. This is platform and software-version evidence. The 2026 advisory lists fixed builds. A patched TS-453Be is not thereby shown to remain vulnerable. Very common describes the repeated vulnerability history, not a measured defect rate for this hardware.
|
| Prior attacks
|
Rare
|
🔗 Proof
|
A first-person owner report identifies a TS-453Be infected by Qlocker in April 2021. QNAP independently confirms the broader Qlocker campaign, but does not verify that individual case. Rare represents an isolated model-specific report. Population frequency and exact affected firmware for that case are unknown. This is historical evidence, not a claim of current compromise.
|
| Updatability
|
Very common
|
🔗 Proof
|
The current model catalog lists QTS 5.2.10, and QTS documents downloadable and live firmware updates with security fixes. Very common reflects the supported update mechanism and continuing QTS release history. The exact model-specific security-support end date has not been verified. The catalog EOL label alone is not evidence that firmware updates are unavailable.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
QTS supports one-way and mutual CHAP for iSCSI. The documented default CHAP setting is one-way, while mutual CHAP is optional and No CHAP is also selectable. Partial therefore reflects authentication that is configurable and not universally mutual. It does not claim that every service lacks authentication.
|
| Communications
|
No encryption
|
🔗 Proof
|
QTS documents HTTP administration on port 8080 and optional HTTPS with TLS and an HTTPS-only setting. The score concerns the documented plaintext HTTP path when HTTPS-only is not enforced. HTTPS/TLS is supported. It would be incorrect to describe all communications as unencrypted or all deployments as using this configuration.
|
| Storage
|
No encryption
|
🔗 Proof
|
Historical primary research directly mounts this model's eMMC boot partitions and edits boot files without a decryption step. This supports No encryption for the documented boot-filesystem layout. QTS separately supports optional AES-256 data-volume encryption. The evidence does not establish that all flash areas, all user disks, or every later firmware version are unencrypted. Current firmware protection of each flash area remains unverified.
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
🔗 Proof
|
QTS provides local users and groups, user deletion and password changes, with shared-folder and application privileges. This supports Full account-management capability, including users with fewer privileges. It does not assert that a particular installation follows least privilege.
|
| Authentication
|
Basic
|
🔗 Proof
|
QTS supports account passwords and optional two-step verification. Physical access to the reset button can reset administrator and security settings. Basic reflects the available password-only mode and physical recovery path. It does not mean two-step verification is absent or that current firmware has a known hard-coded backdoor.
|
| Brute-force protection
|
Exist
|
🔗 Proof
|
QTS can block a client IP after a configurable number of failed logins in a time interval and set the blocking duration. Exist reflects this documented protection. Coverage depends on selected protocols and configuration; it is not a guarantee against every distributed attack.
|
| Event logging
|
Access event logged
|
🔗 Proof
|
QuLog Center provides access logs searchable by user and source IP. A log destination must be configured to enable access logging. Access event logged therefore represents the documented capability once configured, not an assertion that logging is enabled on every installation.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
Initialization requires the user to specify a new administrator password. QTS documents a default password policy of eight characters and a digit, but the HDMI initialization page separately states a 1-64-character input range. Universal complexity enforcement across initialization paths was not verified. The intermediate score avoids asserting mandatory complexity everywhere. Periodic password changes are optional.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
QTS; current product catalog lists QTS 5.2.10. Historical flash evidence is identified separately. (Companion App: Qmanager)
|
| Hardware (CPU / GPU)
|
CPU: Intel Celeron J3455, quad-core 1.5 GHz, burst 2.3 GHz • GPU: Intel HD Graphics 500
|
| Memory & Storage
|
Memory: 4 GB DDR3L SODIMM; maximum 8 GB • Storage: 4 GB eMMC boot flash; four SATA bays for HDD/SSD; disks not included
|
| Power, Battery & Charging
|
Battery: • Power: 90 W external AC adapter, 100-240 VAC input • Charging:
|
| Display & Camera
|
Display: Power/status, LAN, USB and drive LEDs; 2 x HDMI 1.4b outputs • Camera:
|
| Sound & Connectivity
|
Sound: Buzzer; speaker and line-out depend on manufacturing date (removed from units made from 2021-01-01) • Connectivity: 2 x Gigabit Ethernet RJ45; 5 x USB 3.2 Gen 1; PCIe Gen2 x2 expansion
|
| Physical (Dimensions & Mass)
|
Dimensions: 168 x 170 x 226 mm (H x W x D) • Mass: 5.22 lb (net, current vendor specification)
|
Assessment scope and evidence limitations
Documentation reviewed on 23 October 2026. This is a review of documented capabilities and exposure paths, not a hands-on test of a particular unit. Current QTS 5.2.x documentation is used for software controls. The boot-flash findings are explicitly historical and must not be read as a fresh test of QTS 5.2.10. Communications scoring addresses the available plaintext HTTP path, while logging and brute-force scores describe configurable capabilities. Thus this is not an attestation of one uniform default configuration.
The methodology provides no Unknown option and no numerical frequency thresholds. Rare/Very common selections are qualitative assessment judgments. Unknown incident rates, the exact support-end date, current flash-area coverage and cross-path password-complexity enforcement remain explicitly unverified. Missing evidence has not been treated as None or Absent. The owner attack report is lower-assurance evidence than a vendor-confirmed model-specific incident.
General-information sources
Official hardware specification: https://www.qnap.com/en-us/product/ts-453be/specs/hardware
Official launch announcement (14 February 2018): https://www.qnap.com/en-au/news/con_show.php?cid=698
Official QTS 5.2.x user guide: https://docs.qnap.com/operating-system/qts/5.2.x/qts5.2.x-ug-en-us.pdf
Manufacturer revisions affect audio connections and weight. The current catalog marks the hardware EOL; this is not used as proof of the absence of security updates.
Additional evidence URLs
