Synology DiskStation DS920+
Security Evaluation
1. Device Security
2. System Security
3. User Authentication
Technical Specifications
Evidence review addendum β 2026-10-24. Public-document review; ratings with evidence gaps remain provisional.
This addendum supersedes earlier inconsistent wording on the same fields. It is based on public documents and the saved website snapshot; no installed device was tested. Historical research below remains historical evidence. Unverified flash protection and interface-specific controls are not verified device facts.
Documented basic information
- GPU: Intel UHD Graphics 600 integrated in Celeron J4125 Source Source
- η΅ζΊ: 100 W adapter; AC 100β240 V, 50/60 Hz Source
- ε£°ι³: System beep alerts / warning buzzer Source
- εε¨: 4 SATA drive bays + 2 M.2 2280 NVMe SSD slots; installed drives/capacity unspecified Source
- θΏζ₯ζΉεΌ: 2 Gigabit Ethernet; 2 USB 3.2 Gen 1; 1 eSATA Source
Revised security evidence notes
- ζ΄ζ°θ½ε: Official DSM 7.2.2 archives contain the DS920+ base package and a 920+ Update 10 patch. Published branch notes document repeated security updates. This supports update availability, not an observed installation or a latest-major-version claim. Source Source Source Source
- ιͺεεε¨ε ε―: Boot/update logs identify synoboot on a DS920+, but do not establish boot-flash encryption under DSM 7.2.x. Encrypted data volumes are outside this flash-specific claim. Source
Scoring status
Existing selected scores are a saved comparison baseline, not newly validated final scores. Recheck version, region and assessment path before updating options. Recalculate CATS/GRAS and synchronize this section after all selected options are settled. Do not infer a secure or insecure flash state from a downloadable firmware image or encrypted data volumes.
Assessment reviewed 2026-10-22. Documented capability assessment with explicitly labelled assessor inferences; no individual installed device was tested.
Assessment scope
DS920+ with DSM 7.2.x capability baseline; exact current model-specific build unknown. Conditional recommendations assume HTTPS, MFA, Auto Block and access logging enabled. Optional package vulnerabilities excluded unless installed.
The rubric has no numerical frequency thresholds. Qualitative mappings are explained in each comment; an inferred risk rating is not a measured incident rate. Configuration benefits apply only when the specified controls are enabled.
Release date is the official Plus-series announcement, 18 June 2020; regional availability can differ. DS920+ launch
Calculation cross-check
Device CRIS [2, 2, 2, 1], CATS 2. System CRIS [2, 1, 3], CATS 2. User CRIS [1, 2, 1, 1, 1], CATS 2. GRAS 6; expected grade B. Methodology
Evidence and inference notes
- Known hardware tampering: ASSESSOR INFERENCE: Rare denotes a local-possession barrier. Removable trays, reset and exposed ports allow physical modification; locks/security slot add limited resistance. It is a design assessment, not measured attack frequency. DS920+ hardware installation guide
- Known vulnerabilities: ASSESSOR INFERENCE: Rare represents the limited verified historical DSM set reviewed here (CVE-2023-2729 and CVE-2023-0142), not prevalence or a claim that DSM has no other vulnerabilities. Fixes and installed build are separate. Synology-SA-23:07 DSM Synology-SA-23:05 DSM
- Prior attacks: ASSESSOR INFERENCE: Rare is a cautious platform-history estimate. Synology reported 2021 StealthWorker brute-force attacks against NAS accounts after DS920+ launch. The notice does not enumerate DS920+ victims; transfer of shared DSM history to this model is an inference. Synology StealthWorker response DS920+ launch
- Updatability: Repeated DSM 7.2 branch releases, including multiple 2026 security updates, establish frequent update capability. This does not assert that an individual DS920+ is running the latest build. DSM 7 general releases DSM 7.2 guide
- Authentication with other systems: Partial describes supported services: DSM and protected shares authenticate accounts; optional Local Master Browser/guest operation can activate a guest account without a password. Disable guest access in hardened configurations. Complete mutual authentication is not asserted. DSM 7 SMB authentication settings DSM 7.2 guide
- Communications: Assumes HTTPS and encrypted supported transfers, with plaintext/legacy services disabled. DSM 7.2 specifications Synology security controls
- Storage: ASSESSOR INFERENCE, boot-code flash scope: Synology documents GRUB loaded from synoboot flash and DSM root assembled on disks. No encryption is a limited ordinary boot-code inference, separate from optional encrypted data volumes/folders. It does not establish plaintext user files or all saved secrets. Synology boot sequence and synoboot flash DSM 7.2 specifications
- Account management: Users, groups and privilege controls support least-privilege administration when configured. DSM 7.2 guide DSM 7.2 specifications
- Authentication: DSM supports Secure SignIn/MFA. However, the hardware guide documents physical reset of administrator settings; an MFA-capable login alone does not establish secure recovery. Basic is a conservative assessment of this documented recovery boundary, not a claim that MFA is absent. DSM 7.2 guide DS920+ hardware installation guide
- Brute-force protection: Auto Block and Account Protection address repeated login attempts when enabled. DSM Auto Block and Account Protection
- Event logging: Log Center supports access/connection logging; relevant services and retention must be configured. DSM 7.2 specifications
- Passwords: Conditional policy assessment: enable password-strength requirements and require change of administrator-issued/reset passwords at the next login. These provide enforced change plus complexity when configured; the choice is not a claim about every installation default. DSM advanced password settings DSM 7.2 guide
Historical vulnerabilities and remediation
CVE-2023-2729: Insufficient randomness in user management
- Affected scope: DSM before 7.2-64561; relevant only to a susceptible installed DSM branch/build.
- Preconditions: Remote attacker; extra vectors unspecified by vendor.
- Impact: Possible user-credential disclosure.
- Remediation: DSM 7.2-64561 or later; vendor says older listed branches will not fix this issue.
- Severity: CVSS 3.1: 5.9, vendor.
- Evidence: Synology-SA-23:07 DSM
CVE-2023-0142: Backup-management search-path weakness
- Affected scope: DSM 7.1 before 7.1-42661, 7.0 before 7.0.1-42218-7, 6.2 before 6.2.4-25556-8; DSM 7.2 not affected.
- Preconditions: Remote authenticated administrator.
- Impact: Arbitrary file read/write, detailed vendor record.
- Remediation: Branch-specific fixed builds above.
- Severity: CVSS 3.1: 6.5, vendor.
- Evidence: Synology-SA-23:05 DSM
