| QNAP TS-439 Pro
|
|
Security Grade
Calculator v1
|
QNAP TS-439 Pro
Release Date: 2009-02-05 • Status:
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
Qualitative Rare: documented local USB recovery can rewrite internal DOM. Physical-access resistance judgment, not measured tampering incidence.
|
| Known vulnerabilities
|
Rare
|
[1] 🔗 Proof
|
Qualitative Rare for documented 2018 VPNFilter issue: QNAP affected-build advisory plus Talos exact-model list. No measured frequency or claim all updated units remain vulnerable.
|
| Prior attacks
|
Rare
|
🔗 Proof
|
Talos 2018 names this exact model as VPNFilter Known Affected. Rare is qualitative for one campaign; infected build and per-model counts unknown.
|
| Updatability
|
Rare
|
🔗 Proof
|
As-of2026-10-20 model API: six listed2022-2024 releases, latest4.2.6 build20240618 published2024-07-01. Qualitative Rare; not non-updatable or historical4.2.1 cadence.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
QTS4.2.1: optional iSCSI CHAP and Mutual CHAP; partial device-wide authentication, not universally enforced peer authentication.
|
| Communications
|
No encryption
|
🔗 Proof
|
Historical QTS4.2.1 HTTP management on port8080; optional secure login/forced HTTPS also documented. Rating is this HTTP channel, not every service or encryption capability.
|
| Storage
|
No encryption
|
[2] 🔗 Proof
|
No encryption for named internal DOM config filesystem only: official raw ext2 mount and factory-image text file. Not all secrets/partitions or a live QTS4.2.1 dump.
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
[3] 🔗 Proof
|
QTS4.2.1: ordinary users/passwords/groups/folder rights; legacy Users UI has Delete. Built-in admin undeletable; no deletion test performed.
|
| Authentication
|
Basic
|
🔗 Proof
|
QTS4.2.1 username/password with configurable physical reset restoring admin password. Basic for recovery-capable scope; no remote hardcoded-backdoor claim.
|
| Brute-force protection
|
Exist
|
🔗 Proof
|
QTS4.2.1 Network Access Protection can block IPs after failed logins for a period/indefinitely. Configurable, not asserted enabled by default.
|
| Event logging
|
Access event logged
|
🔗 Proof
|
QTS4.2.1 configurable connection/file-action logging; AFP/SSH login/logout only. Start Logging required; not every protocol or factory-enabled logging.
|
| Passwords
|
Default/Common/Easy to guess
|
🔗 Proof
|
Historical QTS4.2.1 manual p28: admin/admin; physical reset also restores admin. Not a current QTS5.2 password claim.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Historical QTS4.2.1 behavior; update cadence separately as-of2026-10-20 (Companion App: )
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: • Power: • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity:
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
Historical QTS4.2.1 documentary assessment, not current-device test or one observed deployment. Exact TS-439 Pro, not ProII/II+. Configurable logging/IP-block/CHAP, not default claims. VPNFilter separately dated2018; victim firmware/count unknown. Update cadence alone as-of2026-10-20, latest listed firmware2024. Date field is QNAP-authored PRNewswire announcement2009-02-05, NOT proven earliest announcement/first shipment; earlier republication date unresolved. Source: https://en.prnasia.com/releases/global/QNAP_Announces_the_World_s_First_4_Bay_Intel_Atom_based_NAS_TS_439_Pro_Turbo_NAS-17124.shtml. Storage refers to internal DOM config filesystem, not HDD AES/all flash secrets: parent independently checked original range206+hash and debugfs reading /customise.conf Model_Name=TS-439. Factory2009 image is not live QTS4.2.1; official autorun docs bridge config use. Rare is qualitative, no measured frequency. Built-in admin undeletable; Full account lifecycle concerns ordinary users. Physical judgment concerns USB internal-DOM reimaging, not measured malicious tampering.
