Synology DiskStation DS923+

Synology DiskStation DS923+
Security Grade B Calculator v1	Synology DiskStation DS923+ 4-Bay NAS Brand: Synology (Parent: Synology Inc.) Category: Network Attached Storage (NAS) • Model / Gen: DS923+ / 2023 Plus series DS923+ Release Date: 2022-11-16 • Status: End of sale Classification Date: 2026-10-28 • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	[[1] 🔗 Proof]	Rare is an assessor judgment for an indoor NAS requiring physical access, not a measured incident rate. The hardware guide documents removable SATA drives, a RESET button, USB/network ports and external power. Someone at the device can remove drives, reset configuration or interrupt power; no claim of tamper resistance is made.
Known vulnerabilities	Very common	[[2] 🔗 Proof]	Recurring DSM security advisories and multiple 2025-2026 security releases establish a repeated platform vulnerability history. This qualitative rating concerns known historical DSM flaws, not a claim that all are present on patched DS923+ units.
Prior attacks	None	[[3] 🔗 Proof]	Focused model-name searches of vendor security information, NVD/CISA-indexed results and security-research reporting on 2026-10-23 did not identify a qualifying model-specific published incident. None means none identified in this review, not immunity or proof of zero incidents. Published Pwn2Own DSM research is platform-level evidence and does not establish an in-the-wild DS923+ incident.
Updatability	Very common	[[4] 🔗 Proof]	Frequent release history includes DSM 7.3.2 in December 2025 and security updates in January and March 2026. Automatic installation is not assumed.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	[[5] 🔗 Proof]	Named credentials protect management and file services; network discovery and configurable services prevent a claim of universal mutual authentication.
Communications	Encrypted with up-to-date encryption	[[6] 🔗 Proof]	Reference profile enables HTTPS management with a valid certificate. This rating covers that management connection; FTP/HTTP and other optional plaintext protocols are not thereby encrypted.
Storage	No encryption	[[7] 🔗 Proof]	Reference profile uses an ordinary shared folder with encryption unchecked. Optional AES-256 folder encryption is available but not selected. Boot/system-flash confidentiality is not verified.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Full	[[8] 🔗 Proof]	DSM supports named users, groups and separate shared-folder/application permissions; reference profile uses least-privilege accounts.
Authentication	Basic	[[9] 🔗 Proof]	Password-based login is available; optional Secure SignIn/2FA can strengthen it. This conservative rating does not certify password recovery, physical reset or firmware authenticity.
Brute-force protection	Exist	[[10] 🔗 Proof]	Reference profile enables Auto Block and Account Protection to restrict repeated failed logins; availability is documented, no attack test performed.
Event logging	Access event logged	[[11] 🔗 Proof]	Log Center includes connection logs and supports filtering/forwarding them; reference profile retains these logs. This does not imply every file read is logged by default.
Passwords	Require change after setup with complexity requirements	[[12] 🔗 Proof]	Configured profile enables password strength rules and forces users to change passwords at next login after policy changes/reset. Mixed case, digits and minimum length are documented options; this is not a factory-default claim.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Synology DiskStation Manager (DSM); assessment scoped to DSM 7.3.2 with vendor security updates (Companion App: DSM web interface; Synology Drive; DS finder; Synology Secure SignIn)
Hardware (CPU / GPU)	CPU: AMD Ryzen R1600, 2 cores / 4 threads • GPU: No integrated graphics; no display-output GPU
Memory & Storage	Memory: 4 GB DDR4 ECC SODIMM; two slots, maximum 32 GB • Storage: Diskless enclosure: 4 SATA drive bays plus 2 M.2 2280 NVMe SSD slots
Power, Battery & Charging	Battery: Not applicable: externally powered desktop NAS; no operating battery • Power: External AC adapter, 100-240 V AC, 50/60 Hz • Charging: Not applicable: external AC power, no battery charging
Display & Camera	Display: Status LEDs; no built-in display • Camera: No built-in camera; external IP cameras require separate hardware
Sound & Connectivity	Sound: System alert buzzer; no multimedia speaker • Connectivity: 2 x 1GbE RJ45; 2 x USB 3.2 Gen1; 1 x eSATA; optional E10G22-T1-Mini 10GbE upgrade
Physical (Dimensions & Mass)	Dimensions: 166 x 199 x 223 mm (H x W x D) • Mass: 2.24 kg

Documentation-only assessment; no device was tested and no certification is claimed. Features depend on installed firmware and configuration. Reference profile: ordinary unencrypted data folders; named accounts, password rules and login-attempt blocking enabled. HTTPS management where stated. Storage rating describes the ordinary data folder and must not be read as a verified claim about all boot/system flash. None for prior attacks means no qualifying model-specific incident identified in focused vendor, NVD/CISA and security-research searches as of 2026-10-23. Frequency labels are qualitative assessor interpretations, not measured incident rates. Hardware tampering is rated Rare as a qualitative judgment for physical-access-dependent actions, not a measured frequency. Release-date scope: Official product launch and same-day availability announcement. Sales-status scope: Vendor status is Discontinued; DSM updates and technical support remain Full.

Proposed IDRS calculation under the assessment scope above: Device 2, System 2, User Authentication 2, total 6, grade B. Source methodology: https://fehmijaafar.net/wiki-iot/index.php/Methodology . This documentation-based rating is not an unconditional security certification.

Firmware scope: DSM 7.3.2 reference profile with security updates; historical DSM advisories remain relevant to unpatched installations. No claim that an unexamined unit is patched.

Additional references:

• [13]
• [14]
• [15]
• [16]
• [17]