| Synology DiskStation DS923+
|
|
Security Grade
Calculator v
|
Synology DiskStation DS923+ 4-Bay NAS
Release Date: 2022-11-16 • Status: End of sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
[[1] 🔗 Proof]
|
Rare is an assessor judgment for an indoor NAS requiring physical access, not a measured incident rate. The hardware guide documents removable SATA drives, a RESET button, USB/network ports and external power. Someone at the device can remove drives, reset configuration or interrupt power; no claim of tamper resistance is made.
|
| Known vulnerabilities
|
Very common
|
[[2] 🔗 Proof]
|
Recurring DSM security advisories and multiple 2025-2026 security releases establish a repeated platform vulnerability history. This qualitative rating concerns known historical DSM flaws, not a claim that all are present on patched DS923+ units.
|
| Prior attacks
|
None
|
[[3] 🔗 Proof]
|
Focused model-name searches of vendor security information, NVD/CISA-indexed results and security-research reporting on 2026-10-23 did not identify a qualifying model-specific published incident. None means none identified in this review, not immunity or proof of zero incidents. Published Pwn2Own DSM research is platform-level evidence and does not establish an in-the-wild DS923+ incident.
|
| Updatability
|
Very common
|
[[4] 🔗 Proof]
|
Frequent release history includes DSM 7.3.2 in December 2025 and security updates in January and March 2026. Automatic installation is not assumed.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
[[5] 🔗 Proof]
|
Named credentials protect management and file services; network discovery and configurable services prevent a claim of universal mutual authentication.
|
| Communications
|
Encrypted with up-to-date encryption
|
[[6] 🔗 Proof]
|
Reference profile enables HTTPS management with a valid certificate. This rating covers that management connection; FTP/HTTP and other optional plaintext protocols are not thereby encrypted.
|
| Storage
|
No encryption
|
[[7] 🔗 Proof]
|
Reference profile uses an ordinary shared folder with encryption unchecked. Optional AES-256 folder encryption is available but not selected. Boot/system-flash confidentiality is not verified.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
[[8] 🔗 Proof]
|
DSM supports named users, groups and separate shared-folder/application permissions; reference profile uses least-privilege accounts.
|
| Authentication
|
Basic
|
[[9] 🔗 Proof]
|
Password-based login is available; optional Secure SignIn/2FA can strengthen it. This conservative rating does not certify password recovery, physical reset or firmware authenticity.
|
| Brute-force protection
|
Exist
|
[[10] 🔗 Proof]
|
Reference profile enables Auto Block and Account Protection to restrict repeated failed logins; availability is documented, no attack test performed.
|
| Event logging
|
Access event logged
|
[[11] 🔗 Proof]
|
Log Center includes connection logs and supports filtering/forwarding them; reference profile retains these logs. This does not imply every file read is logged by default.
|
| Passwords
|
Require change after setup with complexity requirements
|
[[12] 🔗 Proof]
|
Configured profile enables password strength rules and forces users to change passwords at next login after policy changes/reset. Mixed case, digits and minimum length are documented options; this is not a factory-default claim.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Synology DiskStation Manager (DSM); assessment scoped to DSM 7.3.2 with vendor security updates (Companion App: DSM web interface; Synology Drive; DS finder; Synology Secure SignIn)
|
| Hardware (CPU / GPU)
|
CPU: AMD Ryzen R1600, 2 cores / 4 threads • GPU: No integrated graphics; no display-output GPU
|
| Memory & Storage
|
Memory: 4 GB DDR4 ECC SODIMM; two slots, maximum 32 GB • Storage: Diskless enclosure: 4 SATA drive bays plus 2 M.2 2280 NVMe SSD slots
|
| Power, Battery & Charging
|
Battery: Not applicable: externally powered desktop NAS; no operating battery • Power: External AC adapter, 100-240 V AC, 50/60 Hz • Charging: Not applicable: external AC power, no battery charging
|
| Display & Camera
|
Display: Status LEDs; no built-in display • Camera: No built-in camera; external IP cameras require separate hardware
|
| Sound & Connectivity
|
Sound: System alert buzzer; no multimedia speaker • Connectivity: 2 x 1GbE RJ45; 2 x USB 3.2 Gen1; 1 x eSATA; optional E10G22-T1-Mini 10GbE upgrade
|
| Physical (Dimensions & Mass)
|
Dimensions: 166 x 199 x 223 mm (H x W x D) • Mass: 2.24 kg
|
Documentation-only assessment; no device was tested and no certification is claimed. Features depend on installed firmware and configuration. Reference profile: ordinary unencrypted data folders; named accounts, password rules and login-attempt blocking enabled. HTTPS management where stated. Storage rating describes the ordinary data folder and must not be read as a verified claim about all boot/system flash. None for prior attacks means no qualifying model-specific incident identified in focused vendor, NVD/CISA and security-research searches as of 2026-10-23. Frequency labels are qualitative assessor interpretations, not measured incident rates. Hardware tampering is rated Rare as a qualitative judgment for physical-access-dependent actions, not a measured frequency. Release-date scope: Official product launch and same-day availability announcement. Sales-status scope: Vendor status is Discontinued; DSM updates and technical support remain Full.
Proposed IDRS calculation under the assessment scope above: Device 2, System 2, User Authentication 2, total 6, grade B. Source methodology: https://fehmijaafar.net/wiki-iot/index.php/Methodology . This documentation-based rating is not an unconditional security certification.
Firmware scope: DSM 7.3.2 reference profile with security updates; historical DSM advisories remain relevant to unpatched installations. No claim that an unexamined unit is patched.
Additional references:
