Synology DiskStation (DS224j)
Security Evaluation
1. Device Security
2. System Security
3. User Authentication
Technical Specifications
Documentation-based security evaluation for Synology DiskStation DS224j, completed on 2026-10-24.
This 2-bay 2024 entry-level j-series NAS, designed for budget-conscious home personal storage and backup, is assessed against a specific DSM 7.2.2-72806 Update 10 configuration. The setup uses local user accounts with password-only web administration, enables HTTP management access and an NFS AUTH_SYS file share on the home LAN. Supported internal SATA SSDs (requiring optional mounting brackets for 2.5-inch drives) host an unencrypted shared data volume. Auto Block brute-force protection is activated at 5 failed attempts within 5 minutes. Password policies enforce a 12-character minimum with mixed character sets, and all temporary admin-issued passwords must be changed on initial login. Standard physical reset functionality remains enabled. All security ratings apply exclusively to this documented setup, and do not represent factory default settings or hands-on hardware testing.
Security classifications are mapped strictly from official DSM specifications and the explicitly defined deployment profile. The "Rare" rating reflects a qualitative judgment of limited, well-documented risk exposure, not an empirically measured rate of real-world incidents. Historical attack records refer to platform-wide DSM incidents and do not confirm this specific model as a target; all referenced campaigns predate this device's 2024 launch by several years. The active HTTP plaintext management path is the basis for the "No encryption" communications rating. Storage ratings reflect only user data volume encryption status and do not make assumptions about system boot partition security. Optional security features are not counted as active unless explicitly included in the assessment scope. Historical CVE entries do not signify ongoing vulnerability in the fully patched firmware build under review.
Release date reference: 2024-03-12, taken from the official global English / Taipei launch announcement; this date is not claimed to be the earliest point of worldwide retail availability.
Historical vulnerabilities: CVE-2024-10441 (remote code execution), CVE-2024-50629 (file disclosure), CVE-2024-10445 (update certificate flaw). These affect DSM 7.2.2 versions prior to 7.2.2-72806 Update 1; Update 10 used in this assessment includes all corresponding patches.
No physical device was tested during this evaluation. All ratings must be interpreted within the stated configuration and supporting evidence boundaries.
DS224j official launch announcement DS224j official datasheet Synology product sales and support status DS224j DSM release history DSM 7.2 official user guide (PDF) Synology physical reset and its security effects Synology-SA-24:20 — DSM vulnerabilities and fixes Synology PSIRT — StealthWorker attacks, 2021-08-04 DSM NFS permissions — AUTH_SYS and Kerberos DSM shared-folder creation — optional encryption DSM 7.2 technical specifications — accounts and services DSM Auto Block — failed-login limits DSM personal security — login history DSM password strength and forced-change settings WikiIoT methodology
