Synology DiskStation DS423+ (DS423+)
Assessment status: INSUFFICIENT EVIDENCE — NO OVERALL GRADE The previous conditional B grade has been withdrawn because data-volume encryption does not establish the flash-storage encryption required by Methodology. This page is not counted as a completed classification.
Device information
| Field | Value |
|---|---|
| name | Synology DiskStation DS423+ |
| brand | Synology |
| website | https://www.synology.com/en-us/company/news/article/ds423plus |
| release date | 2023-03-15 |
| generation | 23 series |
| model | DS423+ |
| type | NAS |
| operating system | Synology DSM 7.2+; patched configured profile (see scope) |
| companion app | Synology Drive / Secure SignIn (optional) |
| cpu | Intel Celeron J4125 |
| memory | 2 GB DDR4; expandable to 6 GB |
| storage | 4 SATA drive bays; drives and capacity depend on configuration |
| dimensions | 166 x 199 x 223 mm (H x W x D) |
| mass | 2.18 kg |
| power | 100-240 VAC, 50/60 Hz via supplied adapter |
| connectivity | 2 x 1GbE RJ45; 2 x USB 3.2 Gen 1 |
Criterion evidence (not a complete classification)
| Criterion | Finding / CRIS mapping | Evidence and limitations |
|---|---|---|
| Known hardware tampering | Rare / 2 | Desktop four-bay NAS with removable drive trays, USB/network ports, a physical RESET button and a Kensington security slot. Tray locks and a cable lock deter casual removal but do not establish resistance to invasive hardware changes. Physical recovery can alter authentication settings. Rare is a qualitative partial-resistance mapping, not an observed incident rate. Source 1 Source 2 |
| Known vulnerabilities | Very common / 3 | Multiple DSM vulnerabilities are documented across releases. Example CVE-2026-13684: unauthenticated remote arbitrary-file read/write and denial of service, CVSS 3.1 9.8. Affected DSM branches are fixed at 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 or 7.4-90075 and later respectively. Apply the advisory only when the installed DSM version is affected. Very common rates recurring platform vulnerability history; it does not assert that a patched DS423+ is currently exploitable. Source 1 Source 2 |
| Prior attacks | Rare / 2 | Synology reported real StealthWorker credential-guessing attacks in August 2021. This predates this model and is NAS/platform threat history, not a claimed incident on DS423+. No exact-model in-the-wild incident was established in the reviewed material. Rare is a provisional device-class mapping; the site has no Unknown option. Source 1 |
| Updatability | Very common / 1 | DSM supports official software updates and vendor security releases. Install the release offered for this exact model and supported branch; current security patches are an assessment condition. This documents an update mechanism and maintained security releases, not a guaranteed future support period. Source 1 Source 2 |
| Authentication with other systems | Partial / 2 | DSM provides account permissions and AD/LDAP integration, but authentication strength depends on each protocol and client. The reviewed evidence does not establish universal mutual authentication across every supported integration. Guest access is disabled in the assessed profile. Source 1 Source 2 |
| Communications | Encrypted with up-to-date encryption / 1 | Conditional on HTTPS with a validated certificate and TLS 1.2/1.3 for the assessed management/file-transfer paths. DSM provides configurable TLS profiles. HTTP and legacy plaintext protocols are also supported; encryption is not universal or automatically enabled for every service. Source 1 Source 2 |
| Storage | Not established / not scored | WITHHELD: these sources establish encryption of supported user-data volumes, not encryption of the internal flash required by the WikiIoT Storage criterion. Neither plaintext flash nor encrypted flash has been established for this exact model. No CRIS value is assigned. Source 1 Source 2 |
| Account management | Full / 1 | DSM supports multiple named users, groups and application/file permissions. Use distinct least-privilege accounts; this is broader than one shared administrator account. Source 1 Source 2 |
| Authentication | Basic / 2 | Named password accounts and optional two-factor authentication are documented. Basic is conservative because 2FA is configurable and physical recovery can reset administrator/2FA settings unless additional protections are configured. This does not imply that DSM lacks 2FA. Source 1 Source 2 |
| Brute-force protection | Exist / 1 | Auto Block records failed sign-ins and can block source IPs after a configured threshold. It is enabled in the assessed profile, not assumed to be universal by default. Keep DSM patched: CVE-2026-40538 affected the Auto Block mechanism in older branches; SA-26:06 lists the fixed builds. Source 1 Source 2 |
| Event logging | Access event logged / 1 | DSM Login History records access time, protocol and source IP; Account Activity shows sessions, and Log Center can report failed sign-ins. This supports authentication/access logging, not guaranteed recording of every operation or tamper-proof retention. Source 1 Source 2 |
| Passwords | Require change after setup with complexity requirements / 1 | Conditional configured policy: apply password-strength rules and require replacement after provisioning/at next login. DSM supports length/character rules and forcing users to change existing passwords when applying rules. This is an explicitly configured deployment condition, not a claim that every factory installation enforces it. Source 1 |
Assessment scope
Documentation-based configured-deployment assessment dated 2026-10-23, not a factory-default or hands-on test. Scope: official supported DSM 7.2+ with current vendor security patches, named local accounts, HTTPS-only assessed management/file-transfer paths with a trusted certificate and TLS 1.2/1.3, encrypted data volumes, Auto Block enabled, and an administrator-configured password-strength policy with password replacement required after account provisioning. Unused plaintext services and guest access are disabled. These are explicit configuration conditions, not observations of a real installed unit. Hardware recovery remains possible; stronger reset-protection settings are not assumed. Data-volume encryption is documented, but does not meet the flash-evidence requirement; the storage score and overall grade are withheld.
Device and physical boundary
A four-bay network-attached storage appliance for private-cloud file sharing, backup and optional IP-camera recording. DS423+ is the exact manufacturer model. This model has an Intel platform and 2 GB base RAM; it is distinct from the non-Plus DS423.
Desktop four-bay NAS with removable drive trays, USB/network ports, a physical RESET button and a Kensington security slot. Tray locks and a cable lock deter casual removal but do not establish resistance to invasive hardware changes. Physical recovery can alter authentication settings. Rare is a qualitative partial-resistance mapping, not an observed incident rate.
Stored documents, backups and camera recordings can be exposed by compromised accounts or unpatched services. Encryption does not stop an authenticated attacker from modifying unlocked files.
Vulnerabilities and attack attribution
Multiple DSM vulnerabilities are documented across releases. Example CVE-2026-13684: unauthenticated remote arbitrary-file read/write and denial of service, CVSS 3.1 9.8. Affected DSM branches are fixed at 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 or 7.4-90075 and later respectively. Apply the advisory only when the installed DSM version is affected. Very common rates recurring platform vulnerability history; it does not assert that a patched DS423+ is currently exploitable.
The two NAS models share DSM software evidence but have distinct hardware. Platform CVEs apply according to installed DSM/package versions, not merely the brand name. Optional package CVEs have not been represented as unconditional base-device vulnerabilities. SA-24:20 provides additional historical DSM security fixes.
Synology reported real StealthWorker credential-guessing attacks in August 2021. This predates this model and is NAS/platform threat history, not a claimed incident on DS423+. No exact-model in-the-wild incident was established in the reviewed material. Rare is a provisional device-class mapping; the site has no Unknown option.
Classification withdrawn pending evidence — 24 October 2026
The earlier conditional B grade is withdrawn. The WikiIoT methodology explicitly evaluates storage encryption in device flash; data-volume encryption does not establish this. Storage remains unscored. No System category score, overall total or letter grade is claimed, and this page is not counted as a completed course classification. Other criterion mappings are retained as documented findings for the stated deployment, not a substitute for the missing storage evidence. A new classification requires exact-model evidence of flash protection and recalculation. The original revisions remain in page history.
Practical improvements
Keep DSM and installed packages current; disable unused services and guest access; restrict management to a trusted network or VPN; use strong unique passwords and 2FA; enable Auto Block, review login history and preserve off-device logs. Encrypt sensitive volumes, protect recovery keys separately, review reset/unlock settings, secure physical access and keep offline or immutable backups.
Release-date evidence
2023-03-15 is the manufacturer announcement date and stated same-day availability in the linked release. It identifies this exact model, not a retailer listing or a different hardware revision. Regional availability may vary.
Research and originality
Individual documentation review, 2026-10-23. No physical test, exploit attempt or measurement was performed. WikiIoT brand and model-term searches (DS423 and DS923) did not return existing exact-model entries at preparation time; pending/unindexed submissions cannot be ruled out.
Sources
