| ASUSTOR Nimbustor 2 Gen2 (AS5402T)
|
|
Security Grade
Calculator v1
|
ASUSTOR Nimbustor 2 Gen2 AS5402T 2-Bay NAS
Release Date: 2023-07-18 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
Rare is a qualitative assessor judgment under an indoor, physically controlled deployment. The manufacturer diagram identifies a rear reset button, removable drives, USB/network ports and external DC input. A person with access can interrupt power, remove storage or operate reset. No measured tampering rate or comprehensive tamper protection is established.
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
The vendor lists repeated ADM vulnerabilities across 2025-2026. This is qualitative historical platform exposure, not proof that every patched AS5402T remains affected.
|
| Prior attacks
|
None
|
🔗 Proof
|
Focused model-name searches of vendor security information, NVD/CISA-indexed results and security-research reporting on 2026-10-23 did not identify a qualifying model-specific published incident. None means none identified in this review, not immunity or proof of zero incidents. Earlier ASUSTOR-family ransomware reports do not establish an original AS5402T incident.
|
| Updatability
|
Very common
|
🔗 Proof
|
Dated ADM releases include February, April, May, June, August and September 2026, demonstrating frequent maintenance; automatic installation is not assumed.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
User permissions protect file services; HTTP/HTTPS, NFS and discovery support do not establish mutual authentication for every connection.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Configured HTTPS management uses ADM 5.1 TLS 1.3; compatible clients can negotiate X25519+ML-KEM768 hybrid TLS. Plain HTTP/other protocols are outside this scoped rating.
|
| Storage
|
No encryption
|
🔗 Proof
|
Ordinary shared-folder profile leaves optional folder encryption unchecked. AES-256 folder encryption can be enabled separately; boot eMMC/system-flash encryption is not verified.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
🔗 Proof
|
ADM supports local users/groups, folder permissions and role-based access control; separate privilege levels are used in the reference profile.
|
| Authentication
|
Basic
|
🔗 Proof
|
Initialization creates an administrator account and password; hardware reset recovery exists. Baseline login is assessed, without asserting exhaustive recovery or firmware-signature testing.
|
| Brute-force protection
|
Exist
|
🔗 Proof
|
Network Defender blocks IP addresses after failed logins; threshold is configurable. Reference profile enables this protection.
|
| Event logging
|
Access event logged
|
🔗 Proof
|
Reference profile enables File Access Log and retains connection logs. Vendor FAQ states file-access logging is disabled by default, so this requires explicit configuration.
|
| Passwords
|
Require change after setup with complexity requirements
|
🔗 Proof
|
ADM 5.1 supports administrator-enforced complexity and password-expiration rules. Reference profile enables both; this choice is configuration-scoped, not a default claim.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
ASUSTOR Data Master (ADM); assessment scoped to ADM 5.1.4 (Companion App: ADM web interface; AiMaster; AiData; ASUSTOR Control Center)
|
| Hardware (CPU / GPU)
|
CPU: Intel Celeron N5105, quad-core, 2.0-2.9 GHz • GPU: Intel UHD Graphics
|
| Memory & Storage
|
Memory: 4 GB DDR4-2933 SODIMM; expandable to 16 GB (2 x 8 GB) • Storage: Diskless: 2 SATA bays plus 4 M.2 2280 NVMe PCIe slots
|
| Power, Battery & Charging
|
Battery: Not applicable: externally powered desktop NAS; no operating battery • Power: 65 W external AC adapter; rated operation 22.9 W, hibernation 12.7 W • Charging: Not applicable: external AC power, no battery charging
|
| Display & Camera
|
Display: Status LEDs; no integrated screen; HDMI 2.0b output • Camera: No built-in camera; external IP cameras require separate hardware
|
| Sound & Connectivity
|
Sound: HDMI audio to external monitor; system alerts • Connectivity: 2 x 2.5GbE RJ45; 3 x USB 3.2 Gen2; HDMI 2.0b; infrared receiver
|
| Physical (Dimensions & Mass)
|
Dimensions: 170 x 114 x 230 mm (H x W x D) • Mass: 1.71 kg
|
Documentation-only assessment; no device was tested and no certification is claimed. Features depend on installed firmware and configuration. Reference profile: ordinary unencrypted data folders; named accounts, password rules and login-attempt blocking enabled. HTTPS management where stated. Storage rating describes the ordinary data folder and must not be read as a verified claim about all boot/system flash. None for prior attacks means no qualifying model-specific incident identified in focused vendor, NVD/CISA and security-research searches as of 2026-10-23. Frequency labels are qualitative assessor interpretations, not measured incident rates. Hardware tampering is rated Rare as a qualitative judgment for physical-access-dependent actions, not a measured frequency. Release-date scope: Official ASUSTOR launch announcement date for original AS5402T, not a later v2 revision. Sales-status scope: Official product support status lists AS5402T Generally Available.
Proposed IDRS calculation under the assessment scope above: Device 2, System 2, User Authentication 2, total 6, grade B. Source methodology: https://fehmijaafar.net/wiki-iot/index.php/Methodology . This documentation-based rating is not an unconditional security certification.
Firmware scope: ADM 5.1.4 reference configuration on AS54 series; optional PHP/web-server packages excluded. Current October 2026 PHP advisory must be checked before enabling those packages.
Additional references:
