Synology DiskStation (DS3622xs+)
Security Evaluation
1. Device Security
2. System Security
3. User Authentication
Technical Specifications
Documentation-driven security assessment for Synology DiskStation DS3622xs+, completed on 2026-10-24.
This 12-bay xs-series flagship NAS, powered by an Intel Xeon processor with dual 10GbE ports for small business and workgroup deployments, is evaluated against a specific DSM 7.2.2-72806 Update 10 configuration. The deployment uses local user accounts with password-only web administration, enables HTTP management access and an NFS AUTH_SYS file share on the corporate LAN. Supported internal SATA SSDs host an unencrypted shared data volume, with PCIe expansion and redundant power supplies present but not part of the security assessment scope. Auto Block brute-force protection is activated at 5 failed attempts within 5 minutes. Password policies enforce a 12-character minimum with mixed character sets, and all temporary admin passwords must be changed on initial login. Standard physical reset functionality remains enabled. All ratings apply solely to this documented configuration, and do not represent factory defaults or hands-on hardware testing.
Security ratings are mapped directly from published DSM specifications and the explicitly defined deployment profile. The "Rare" classification denotes a qualitative judgment of limited, well-defined risk exposure, not an empirically measured occurrence rate. Historical attack entries refer to platform-wide DSM incidents and do not confirm this enterprise model was specifically targeted; most documented campaigns focus on consumer and small-business deployments. The active HTTP plaintext management interface across all network ports is the basis for the "No encryption" communications rating. Storage ratings reflect only user data volume encryption status and do not assume encryption for system boot components. Optional enterprise security features are not treated as active unless explicitly included in the assessment scope. Historical CVE records do not imply vulnerability in the fully patched firmware build under review.
Release date reference: 2021-09-14, as stated in the official global English / Taipei launch announcement; this date is not claimed to be the earliest point of worldwide retail sale.
Historical vulnerabilities: CVE-2024-10441 (remote code execution), CVE-2024-50629 (limited file disclosure), CVE-2024-10445 (update certificate validation flaw). These affect DSM 7.2.2 prior to 7.2.2-72806 Update 1; Update 10 used in this assessment includes all corresponding patches.
No physical device was tested during this evaluation. All ratings must be interpreted within the stated configuration and supporting evidence scope.
DS3622xs+ official launch announcement DS3622xs+ official datasheet Synology product sales and support status DS3622xs+ DSM release history DSM 7.2 official user guide (PDF) Synology physical reset and its security effects Synology-SA-24:20 — DSM vulnerabilities and fixes Synology PSIRT — StealthWorker attacks, 2021-08-04 DSM NFS permissions — AUTH_SYS and Kerberos DSM shared-folder creation — optional encryption DSM 7.2 technical specifications — accounts and services DSM Auto Block — failed-login limits DSM personal security — login history DSM password strength and forced-change settings WikiIoT methodology
