Synology DiskStation (DS124)

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	[1] 🔗 Proof	Physical reset and removable drives create a local tampering surface; Rare is an exposure judgment.
Known vulnerabilities	Rare	🔗 Proof	DSM has published CVEs; the cited affected builds are historical, not the patched assessment build.
Prior attacks	Rare	🔗 Proof	The cited 2021 StealthWorker campaign concerns the DSM NAS platform; it does not identify this model as a victim and may predate its release.
Updatability	Very common	[2] 🔗 Proof	Model-specific release history shows repeated DSM maintenance and security updates.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	NFS AUTH_SYS trusts client UID/GID; the profile does not require mutual cryptographic authentication.
Communications	No encryption	[3] 🔗 Proof	HTTP is enabled in the assessed profile; optional HTTPS does not protect that plaintext path.
Storage	No encryption	[4] 🔗 Proof	User data on the profile's internal SATA SSDs is unencrypted; optional encryption is not enabled.
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	DSM manages administrator and restricted-user accounts, removal, permissions and password changes.
Authentication	Basic	[5] 🔗 Proof	Password-only DSM access is assessed; physical account recovery limits the rating to Basic.
Brute-force protection	Exist	[6] 🔗 Proof	Auto Block is enabled in the profile; repeated failed logins cause an IP block.
Event logging	Access event logged	🔗 Proof	DSM records login sessions with time, protocol and client IP.
Passwords	Require change after setup with complexity requirements	🔗 Proof	This profile enforces replacement of temporary passwords and a 12-character mixed-case/digit policy.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Synology DSM; assessment: DSM 7.2.2-72806 Update 10 (Companion App: DS finder (Android/iOS); DSM web interface)
Hardware (CPU / GPU)	CPU: Realtek RTD1619B; 4 cores; 1.7 GHz • GPU:
Memory & Storage	Memory: 1 GB DDR4 non-ECC • Storage: 1 × SATA HDD/SSD bays; drives sold separately; 2.5-inch SATA SSD requires the optional disk holder
Power, Battery & Charging	Battery: • Power: 100–240 V AC; 50/60 Hz • Charging:
Display & Camera	Display: Status LEDs • Camera:
Sound & Connectivity	Sound: System notification buzzer • Connectivity: 1 × 1GbE RJ-45; 2 × USB 3.2 Gen 1
Physical (Dimensions & Mass)	Dimensions: 166 × 71 × 224 mm (H × W × D) • Mass: 0.7 kg

Documentation-based security assessment: Synology DiskStation DS124. Reviewed 2026-10-24.

Documentation-based assessment of a defined DSM 7.2.2-72806 Update 10 local-NAS profile. Native local users are used, with password-only DSM login. HTTP management and an NFS AUTH_SYS share are enabled on the LAN. Supported internal SATA SSDs, using the model-required disk holders where specified, hold the assessed unencrypted data volume and shared folder. Auto Block is enabled at 5 failed attempts within 5 minutes. The password policy requires at least 12 characters, upper- and lower-case letters and a digit; temporary administrator-assigned passwords must be replaced at the next sign-in. The standard physical reset behaviour is retained. These are the explicitly selected conditions of this document assessment, not a claim about factory defaults or an inspected physical unit.

Ratings map documented capabilities and the stated configuration to WikiIoT choices. Rare is a qualitative assessment of documented bounded exposure/history, not a measured frequency. Prior attacks is explicitly platform-level history; the sources do not identify each selected model as a confirmed victim, and some campaigns predate individual model releases. An enabled plaintext path is rated No encryption. Storage covers user data on internal SATA SSD flash, without inferring the state of every boot component. Optional capabilities are not treated as enabled unless the assessment configuration states so. Historical CVEs do not imply that the selected patched firmware remains vulnerable.

Release-date scope: 2023-08-09, the date stated in the body of the official global English / Taipei launch announcement; not asserted to be the earliest worldwide retail date.

Historical vulnerability: CVE-2024-10441; CVE-2024-50629; CVE-2024-10445. DSM 7.2.2 before 7.2.2-72806 Update 1 (see advisory for other branches). DSM 7.2.2-72806 Update 1 or later fixes the listed issues; this assessment uses Update 10.

No physical device was tested. Keep the configuration and evidence scope with the ratings.

References: DS124 official launch announcement DS124 official datasheet Synology product sales and support status DS124 DSM release history DSM 7.2 official user guide (PDF) Synology physical reset and its security effects Synology-SA-24:20 — DSM vulnerabilities and fixes Synology PSIRT — StealthWorker attacks, 2021-08-04 DSM NFS permissions — AUTH_SYS and Kerberos DSM shared-folder creation — optional encryption DSM 7.2 technical specifications — accounts and services DSM Auto Block — failed-login limits DSM personal security — login history DSM password strength and forced-change settings WikiIoT methodology