Synology DiskStation (DS423+)
Security Evaluation
1. Device Security
2. System Security
3. User Authentication
Technical Specifications
Security assessment based on official documentation for Synology DiskStation DS423+, reviewed 2026-10-24.
This 4-bay 2023 plus-series NAS, positioned as a balanced upgrade for home and small office storage, is evaluated under a defined DSM 7.2.2-72806 Update 10 configuration. The setup employs local user accounts with password-only web access, enables HTTP administration and an NFS AUTH_SYS share on the local network, and hosts an unencrypted shared data volume on supported internal SATA SSDs with dual M.2 cache slots. Auto Block protection is enabled to block brute-force login attempts after 5 failures in 5 minutes. A strong password policy is in place: 12-character minimum with mixed case and numbers, plus mandatory change for all temporary passwords set by the admin. Standard physical reset functionality is retained. All conclusions are specific to this documented configuration, and do not represent factory default settings or physical device testing.
Security ratings are derived strictly from published DSM features and the explicitly defined profile above. The "Rare" classification is a qualitative judgment of limited known risk exposure, not a statistically measured frequency of real-world attacks. Historical attack references apply to the broader DSM platform, and all documented campaigns occurred before this model was launched. The active HTTP plaintext management interface is the basis for the "No encryption" communications rating. Storage ratings apply only to user data volumes, and no assumptions are made about boot partition encryption status. Optional security features are not considered enabled unless explicitly part of the assessment scope. Historical CVE records do not mean the fully patched firmware version in use remains vulnerable.
Release date scope: 2023-05-17, sourced from the official global English / Taipei launch announcement; this is not presented as the earliest date of worldwide retail availability.
Historical vulnerabilities referenced: CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445. These issues affect DSM 7.2.2 versions before 7.2.2-72806 Update 1; Update 10 used in this assessment includes all relevant security fixes.
No physical hardware was tested for this evaluation. All security ratings must be read alongside the stated configuration and evidence boundaries.
DS423+ official launch announcement DS423+ official datasheet Synology product sales and support status DS423+ DSM release history DSM 7.2 official user guide (PDF) Synology physical reset and its security effects Synology-SA-24:20 — DSM vulnerabilities and fixes Synology PSIRT — StealthWorker attacks, 2021-08-04 DSM NFS permissions — AUTH_SYS and Kerberos DSM shared-folder creation — optional encryption DSM 7.2 technical specifications — accounts and services DSM Auto Block — failed-login limits DSM personal security — login history DSM password strength and forced-change settings WikiIoT methodology
