You do not have permission to edit this page, for the following reasons:
'''Evidence review addendum — 2026-10-24. Public-document review; ratings with evidence gaps remain provisional.''' This addendum supersedes earlier inconsistent wording on the same fields. It is based on public documents and the saved website snapshot; no installed device was tested. Historical research below remains historical evidence. Unverified flash protection and interface-specific controls are not verified device facts. == Documented basic information == * GPU: Intel UHD Graphics 600 integrated in Celeron J4125 [https://www.intel.com/content/www/us/en/products/sku/197305/intel-celeron-processor-j4125-4m-cache-up-to-2-70-ghz/specifications.html Source] [https://global.download.synology.com/download/Document/Hardware/ProductSpec/DiskStation/20-year/DS920%2B/enu/Product_Spec_DS920%2B_enu.pdf Source] * 电源: 100 W adapter; AC 100–240 V, 50/60 Hz [https://global.download.synology.com/download/Document/Hardware/ProductSpec/DiskStation/20-year/DS920%2B/enu/Product_Spec_DS920%2B_enu.pdf Source] * 声音: System beep alerts / warning buzzer [https://global.download.synology.com/download/Document/Hardware/HIG/DiskStation/20-year/DS920%2B/enu/Syno_HIG_DS920_Plus_enu.pdf Source] * 存储: 4 SATA drive bays + 2 M.2 2280 NVMe SSD slots; installed drives/capacity unspecified [https://global.download.synology.com/download/Document/Hardware/ProductSpec/DiskStation/20-year/DS920%2B/enu/Product_Spec_DS920%2B_enu.pdf Source] * 连接方式: 2 Gigabit Ethernet; 2 USB 3.2 Gen 1; 1 eSATA [https://global.download.synology.com/download/Document/Hardware/ProductSpec/DiskStation/20-year/DS920%2B/enu/Product_Spec_DS920%2B_enu.pdf Source] == Revised security evidence notes == * 更新能力: Official DSM 7.2.2 archives contain the DS920+ base package and a 920+ Update 10 patch. Published branch notes document repeated security updates. This supports update availability, not an observed installation or a latest-major-version claim. [https://www.synology.com/de-de/releaseNote/DSM?model=RS820%2B Source] [https://archive.synology.com/download/Os/DSM/7.2.2-72806 Source] [https://www.synology.com/en-us/security/advisory/Synology_SA_26_06 Source] [https://archive.synology.com/download/Os/DSM/7.2.2-72806-10 Source] * 闪存存储加密: Boot/update logs identify synoboot on a DS920+, but do not establish boot-flash encryption under DSM 7.2.x. Encrypted data volumes are outside this flash-specific claim. [https://www.ucmadscientist.com/almost-lost-it-all-again/ Source] == Scoring status == Existing selected scores are a saved comparison baseline, not newly validated final scores. Recheck version, region and assessment path before updating options. Recalculate CATS/GRAS and synchronize this section after all selected options are settled. Do not infer a secure or insecure flash state from a downloadable firmware image or encrypted data volumes. ---- '''Assessment reviewed 2026-10-22. Documented capability assessment with explicitly labelled assessor inferences; no individual installed device was tested.''' == Assessment scope == DS920+ with DSM 7.2.x capability baseline; exact current model-specific build unknown. Conditional recommendations assume HTTPS, MFA, Auto Block and access logging enabled. Optional package vulnerabilities excluded unless installed. The rubric has no numerical frequency thresholds. Qualitative mappings are explained in each comment; an inferred risk rating is not a measured incident rate. Configuration benefits apply only when the specified controls are enabled. Release date is the official Plus-series announcement, 18 June 2020; regional availability can differ. [https://www.synology.com/en-me/company/news/article/Plus_20series DS920+ launch] == Calculation cross-check == Device CRIS [2, 2, 2, 1], CATS 2. System CRIS [2, 1, 3], CATS 2. User CRIS [1, 2, 1, 1, 1], CATS 2. GRAS 6; expected grade B. [https://fehmijaafar.net/wiki-iot/index.php/Methodology Methodology] == Evidence and inference notes == * Known hardware tampering: ASSESSOR INFERENCE: Rare denotes a local-possession barrier. Removable trays, reset and exposed ports allow physical modification; locks/security slot add limited resistance. It is a design assessment, not measured attack frequency. [https://global.download.synology.com/download/Document/Hardware/HIG/DiskStation/20-year/DS920%2B/enu/Syno_HIG_DS920_Plus_enu.pdf DS920+ hardware installation guide] * Known vulnerabilities: ASSESSOR INFERENCE: Rare represents the limited verified historical DSM set reviewed here (CVE-2023-2729 and CVE-2023-0142), not prevalence or a claim that DSM has no other vulnerabilities. Fixes and installed build are separate. [https://www.synology.com/en-global/security/advisory/Synology_SA_23_07 Synology-SA-23:07 DSM] [https://www.synology.com/en-global/security/advisory/Synology_SA_23_05 Synology-SA-23:05 DSM] * Prior attacks: ASSESSOR INFERENCE: Rare is a cautious platform-history estimate. Synology reported 2021 StealthWorker brute-force attacks against NAS accounts after DS920+ launch. The notice does not enumerate DS920+ victims; transfer of shared DSM history to this model is an inference. [https://www.synology.com/en-us/company/news/article/BruteForce/Synology%C2%AE%20Investigates%20Ongoing%20Brute-Force%20Attacks%20From%20Botnet Synology StealthWorker response] [https://www.synology.com/en-me/company/news/article/Plus_20series DS920+ launch] * Updatability: Repeated DSM 7.2 branch releases, including multiple 2026 security updates, establish frequent update capability. This does not assert that an individual DS920+ is running the latest build. [https://www.synology.com/en-global/releaseNote/DSM?os=DSM&version=7 DSM 7 general releases] [https://global.download.synology.com/download/Document/Software/UserGuide/Os/DSM/7.2/enu/Syno_UsersGuide_NAServer_7_2_enu.pdf DSM 7.2 guide] * Authentication with other systems: Partial describes supported services: DSM and protected shares authenticate accounts; optional Local Master Browser/guest operation can activate a guest account without a password. Disable guest access in hardened configurations. Complete mutual authentication is not asserted. [https://kb.synology.com/sv-se/DSM/help/SMBService/smbservice_smb_settings?version=7 DSM 7 SMB authentication settings] [https://global.download.synology.com/download/Document/Software/UserGuide/Os/DSM/7.2/enu/Syno_UsersGuide_NAServer_7_2_enu.pdf DSM 7.2 guide] * Communications: Assumes HTTPS and encrypted supported transfers, with plaintext/legacy services disabled. [https://www.synology.com/en-nz/dsm/7.2/software_spec/dsm DSM 7.2 specifications] [https://www.synology.com/en-us/dsm/overview/security Synology security controls] * Storage: ASSESSOR INFERENCE, boot-code flash scope: Synology documents GRUB loaded from synoboot flash and DSM root assembled on disks. No encryption is a limited ordinary boot-code inference, separate from optional encrypted data volumes/folders. It does not establish plaintext user files or all saved secrets. [https://kb.synology.com/en-uk/DSM/tutorial/Overview_of_LED_indicator_statuses_during_bootup Synology boot sequence and synoboot flash] [https://www.synology.com/en-nz/dsm/7.2/software_spec/dsm DSM 7.2 specifications] * Account management: Users, groups and privilege controls support least-privilege administration when configured. [https://global.download.synology.com/download/Document/Software/UserGuide/Os/DSM/7.2/enu/Syno_UsersGuide_NAServer_7_2_enu.pdf DSM 7.2 guide] [https://www.synology.com/en-nz/dsm/7.2/software_spec/dsm DSM 7.2 specifications] * Authentication: DSM supports Secure SignIn/MFA. However, the hardware guide documents physical reset of administrator settings; an MFA-capable login alone does not establish secure recovery. Basic is a conservative assessment of this documented recovery boundary, not a claim that MFA is absent. [https://global.download.synology.com/download/Document/Software/UserGuide/Os/DSM/7.2/enu/Syno_UsersGuide_NAServer_7_2_enu.pdf DSM 7.2 guide] [https://global.download.synology.com/download/Document/Hardware/HIG/DiskStation/20-year/DS920%2B/enu/Syno_HIG_DS920_Plus_enu.pdf DS920+ hardware installation guide] * Brute-force protection: Auto Block and Account Protection address repeated login attempts when enabled. [https://kb.synology.com/index.php/en-uk/DSM/help/DSM/AdminCenter/connection_security_protection?version=7 DSM Auto Block and Account Protection] * Event logging: Log Center supports access/connection logging; relevant services and retention must be configured. [https://www.synology.com/en-nz/dsm/7.2/software_spec/dsm DSM 7.2 specifications] * Passwords: Conditional policy assessment: enable password-strength requirements and require change of administrator-issued/reset passwords at the next login. These provide enforced change plus complexity when configured; the choice is not a claim about every installation default. [https://kb.synology.com/en-br/DSM/help/DSM/AdminCenter/file_user_advanced?version=7 DSM advanced password settings] [https://global.download.synology.com/download/Document/Software/UserGuide/Os/DSM/7.2/enu/Syno_UsersGuide_NAServer_7_2_enu.pdf DSM 7.2 guide] == Historical vulnerabilities and remediation == === CVE-2023-2729: Insufficient randomness in user management === * Affected scope: DSM before 7.2-64561; relevant only to a susceptible installed DSM branch/build. * Preconditions: Remote attacker; extra vectors unspecified by vendor. * Impact: Possible user-credential disclosure. * Remediation: DSM 7.2-64561 or later; vendor says older listed branches will not fix this issue. * Severity: CVSS 3.1: 5.9, vendor. * Evidence: [https://www.synology.com/en-global/security/advisory/Synology_SA_23_07 Synology-SA-23:07 DSM] === CVE-2023-0142: Backup-management search-path weakness === * Affected scope: DSM 7.1 before 7.1-42661, 7.0 before 7.0.1-42218-7, 6.2 before 6.2.4-25556-8; DSM 7.2 not affected. * Preconditions: Remote authenticated administrator. * Impact: Arbitrary file read/write, detailed vendor record. * Remediation: Branch-specific fixed builds above. * Severity: CVSS 3.1: 6.5, vendor. * Evidence: [https://www.synology.com/en-global/security/advisory/Synology_SA_23_05 Synology-SA-23:05 DSM]
For new submissions, pages will appear blank until approval.
Summary: This is a minor edit Watch this page
Save page Show preview Show changes Cancel
