Synology DiskStation (DS1520+)

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	[1] 🔗 Proof	Physical reset and removable drives create a local tampering surface; Rare is an exposure judgment.
Known vulnerabilities	Rare	🔗 Proof	DSM has published CVEs; the cited affected builds are historical, not the patched assessment build.
Prior attacks	Rare	🔗 Proof	StealthWorker attacked the Synology NAS family; this does not establish this exact model as a victim.
Updatability	Very common	[2] 🔗 Proof	Model-specific release history shows repeated DSM maintenance and security updates.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	NFS AUTH_SYS trusts client UID/GID; the profile does not require mutual cryptographic authentication.
Communications	No encryption	[3] 🔗 Proof	HTTP is enabled in the assessed profile; optional HTTPS does not protect that plaintext path.
Storage	No encryption	[4] 🔗 Proof	User data on the profile's internal SATA SSDs is unencrypted; optional encryption is not enabled.
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	DSM manages administrator and restricted-user accounts, removal, permissions and password changes.
Authentication	Basic	[5] 🔗 Proof	Password-only DSM access is assessed; physical account recovery limits the rating to Basic.
Brute-force protection	Exist	[6] 🔗 Proof	Auto Block is enabled in the profile; repeated failed logins cause an IP block.
Event logging	Access event logged	🔗 Proof	DSM records login sessions with time, protocol and client IP.
Passwords	Require change after setup with complexity requirements	🔗 Proof	This profile enforces replacement of temporary passwords and a 12-character mixed-case/digit policy.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Synology DSM; assessed profile: DSM 7.2.2-72806 Update 10 (Companion App: DS finder (Android/iOS); DSM web interface)
Hardware (CPU / GPU)	CPU: Intel Celeron J4125; 4 cores; 2.0–2.7 GHz • GPU:
Memory & Storage	Memory: 8 GB DDR4 non-ECC (4 GB onboard + 4 GB SO-DIMM) • Storage: 5 × 3.5/2.5-inch SATA HDD/SSD bays; 2 × M.2 2280 NVMe slots; drives sold separately
Power, Battery & Charging	Battery: • Power: 100–240 V AC; 50/60 Hz • Charging:
Display & Camera	Display: Status LEDs • Camera:
Sound & Connectivity	Sound: System notification buzzer • Connectivity: 4 × 1GbE RJ-45; 2 × USB 3.0; 2 × eSATA
Physical (Dimensions & Mass)	Dimensions: 166 × 230 × 223 mm (H × W × D) • Mass: 2.62 kg

Documentation-based security assessment: Synology DiskStation DS1520+. Reviewed 2026-10-23.

Documentation-based assessment of a defined DSM 7.2.2-72806 Update 10 local-NAS profile. Native local users are used, with password-only DSM login. HTTP management and an NFS AUTH_SYS share are enabled on the LAN. Supported internal SATA SSDs hold the assessed unencrypted data volume and shared folder. Auto Block is enabled at 5 failed attempts within 5 minutes. The password policy requires at least 12 characters, upper- and lower-case letters and a digit; temporary administrator-assigned passwords must be replaced at the next sign-in. The standard physical reset behaviour is retained. These are the explicitly selected conditions of this document assessment, not a claim about factory defaults or an inspected physical unit.

Ratings are reasoned mappings to WikiIoT options. Rare is used for a documented, bounded physical exposure or vulnerability/attack history; it is not a measured incident rate. Prior attacks refers to the documented Synology DSM NAS family campaign, not a claim that this exact model was a confirmed victim. For mixed protection, an enabled plaintext path is rated No encryption. Storage includes user data on internal SATA SSD flash in this profile; this does not assert the encryption state of every boot component. Exist, Full and Access event logged describe documented controls within the stated profile. Historical CVEs are retained as history after remediation.

Release date is the date of the cited global English announcement: 2020-08-20. It is not asserted to be the earliest worldwide retail date.

Historical vulnerability examples: CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445. For the DSM 7.2.2 branch, Synology-SA-24:20 specifies 7.2.2-72806 Update 1 or later as the fixed release. The assessment profile uses Update 10 and does not claim that these historical issues remain unpatched.

No physical device was tested. The configuration scope and qualitative rating rationale are part of this assessment and must be retained with the selected values.

References: Official launch: DS1520+ DS1520+ official datasheet (hardware/security) DS1520+ DSM release history Synology product availability and support status Synology-SA-24:20 — DSM vulnerabilities and fixes Synology-SA-24:27 — additional DSM vulnerability history Synology PSIRT — StealthWorker attacks, 2021-08-04 Synology physical reset and its security effects DSM NFS permissions — AUTH_SYS and Kerberos DSM 7.2 official user guide (PDF) DSM shared-folder creation — optional encryption DSM 7.2 technical specifications — accounts and services DSM Auto Block — failed-login limits DSM personal security — login history DSM password strength and forced-change settings WikiIoT methodology