Synology RackStation RS2211+
Security Evaluation
1. Device Security
2. System Security
3. User Authentication
Technical Specifications
HISTORICAL DOCUMENTATION-BASED ASSESSMENT, NOT A CURRENT-2026 SECURITY CLAIM. Product release date is the manufacturer's dated launch/availability announcement. Evaluated legacy software: DSM 4.0 in the unpatched range before 4.0-2259 (the SynoLocker report identifies 4.0-2257 or earlier). Attack and maintenance history is considered through 6 August 2014. The documented comparison profile uses the HTTP DSM management channel, single CHAP for an iSCSI target, and unencrypted built-in service-data folders. Account management, Auto Block and event logging are evaluated as documented capabilities. No ten physical units were tested or configured. The products originally shipped with earlier DSM releases; DSM 4.0 is the explicitly supported comparison version.
PRODUCT / DATE EVIDENCE: https://www.synology.com/en-global/company/news/article/Synology_Launches_RackStation_RS2211_and_RS2211RP_NAS_Servers Official launch/availability date: 2011-03-29 DSM 4.0 compatibility (model explicitly listed): https://www.synology.com/en-global/company/news/article/Synology_Announces_the_Official_Release_of_DiskStation_Manager_4_0
Scoring convention: WikiIoT supplies no numerical cutoffs for Rare or Very common. A physical-access-only reset path is mapped to Rare (2); multiple confirmed CVEs and repeated confirmed NAS attacks are mapped to the high category (3); repeated historical vendor releases and fixes map to frequent updating (1). These are analyst categories supported by the cited facts, not vendor-published scores or per-model incident counts. Shared DSM evidence is applicable because the official release lists every hardware model. No individual model is falsely claimed to have a recorded infection.
Device ceil((2+3+3+1)/4)=3; System ceil((2+3+3)/3)=3; User Authentication ceil((1+2+1+1+3)/5)=2; GRAS=8. Grade v1 D / v2 F (methodology-dependent). Administrator-only calculator-version and classification-date fields are not set.
Device / Known hardware tampering | Rare | CRIS 2 Rare (2): the documented physical RESET procedure clears the administrator password after a four-second press. Physical possession is required. This is a local tampering/recovery exposure, not a measured incident rate. https://global.download.synology.com/download/Document/Software/UserGuide/Firmware/DSM/4.0/enu/Syno_UsersGuide_NAServer_enu.pdf#page=161 | Press and hold the RESET button on the back panel of your Synology DiskStation for 4 seconds until you heard a beep sound.
Device / Known vulnerabilities | Very common | CRIS 3 Very common (3) is the high qualitative category for multiple documented historical DSM vulnerabilities. Synology confirms CVE-2013-6955 and CVE-2013-6987; CVE-2013-6955 explicitly affects DSM 4.0 before 4.0-2259. This assessment covers that unpatched legacy range, not patched current software. https://www.synology.com/en-global/company/news/article/Synology_Fixes_Vulnerability_in_DiskStation_Manager | Synology® confirmed known security issues (reported as CVE-2013-6955 and CVE-2013-6987) https://www.cve.org/CVERecord?id=CVE-2013-6955 | webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files, and consequently execute arbitrary code, via a pathname in the SLICEUPLOAD X-TMP-FILE HTTP header.
Device / Prior attacks | Very common | CRIS 3 Very common (3) reflects repeated confirmed attacks against this NAS/DSM device type, including the malicious processes described in February 2014 and SynoLocker in August 2014. The latter explicitly identifies DSM 4.0-2257 or earlier. Reports do not give infection counts for each individual hardware model. https://www.synology.com/en-global/company/news/article/Synology_Encourages_Users_to_Update_as_SynoLocker_Ransomware_Affects_Older_DSM_Versions | Synology has confirmed the ransomware affects Synology NAS servers running older versions of DiskStation Manager https://www.synology.com/en-global/company/news/article/Synology_Encourages_Users_to_Update_as_SynoLocker_Ransomware_Affects_Older_DSM_Versions | DSM 4.0-2257 or earlier https://www.synology.com/en-global/company/news/article/Synology_Fixes_Vulnerability_in_DiskStation_Manager | Synology has taken immediate actions to fix vulnerability at the point of identifying malicious attacks.
Device / Updatability | Very common | CRIS 1 Very common (1) evaluates historical vendor maintenance: official DSM 4.0 and 4.3 releases and subsequent security fixes were published for these supported models. The release announcements explicitly list model compatibility. This is not a statement of ongoing support in 2026. https://www.synology.com/en-global/company/news/article/Synology_Announces_the_Official_Release_of_DiskStation_Manager_4_0 | March 6, 2012 https://www.synology.com/en-global/company/news/article/Synology_Releases_DiskStation_Manager_4_3 | August 27, 2013 https://www.synology.com/en-global/company/news/article/Synology_Encourages_Users_to_Update_as_SynoLocker_Ransomware_Affects_Older_DSM_Versions | DSM 4.0-2259 or later
System / Authentication with other systems | Partial | CRIS 2 Partial (2) for the documented single-CHAP iSCSI profile: the server authenticates the client. The manual explicitly distinguishes this from Mutual CHAP, where both authenticate each other. Mutual CHAP capability is not treated as enabled in the evaluated profile. https://global.download.synology.com/download/Document/Software/UserGuide/Firmware/DSM/4.0/enu/Syno_UsersGuide_NAServer_enu.pdf#page=34 | If you select CHAP, the server will be able to verify the client's identity. In Mutual CHAP, both the client and the server will authenticate each other.
System / Communications | No encryption | CRIS 3 No encryption (3) for the documented HTTP DSM management channel at port 5000 in this historical profile. HTTPS is available as a separate configuration; it does not encrypt the HTTP channel evaluated here. https://global.download.synology.com/download/Document/Software/UserGuide/Firmware/DSM/4.0/enu/Syno_UsersGuide_NAServer_enu.pdf#page=10 | http://Synology_Server_IP:5000
System / Storage | No encryption | CRIS 3 No encryption (3) covers stored data in built-in service folders in DSM 4.0. The manual explicitly says web, photo, music, video, surveillance, download and Netbackup cannot be encrypted. Optional AES encryption of other shared folders does not protect these excluded folders. No claim is made about encryption of every byte of firmware flash. https://global.download.synology.com/download/Document/Software/UserGuide/Firmware/DSM/4.0/enu/Syno_UsersGuide_NAServer_enu.pdf#page=63 | The following built-in shared folders are not allowed for encryption since they are associated with system services: web, photo, music, video, surveillance, download, Netbackup.
User Authentication / Account management | Full | CRIS 1 Full (1): the manual documents creating restricted user accounts (p.56), deleting users (p.57), changing passwords (p.14), and administrator versus ordinary groups (p.59). These are account-management capabilities, not assumptions about an inspected unit. https://global.download.synology.com/download/Document/Software/UserGuide/Firmware/DSM/4.0/enu/Syno_UsersGuide_NAServer_enu.pdf#page=56 | Read only: The user can access the files and subfolders in the shared folder, but cannot make changes to them. https://global.download.synology.com/download/Document/Software/UserGuide/Firmware/DSM/4.0/enu/Syno_UsersGuide_NAServer_enu.pdf#page=57 | Select the user you want to delete and click Delete. https://global.download.synology.com/download/Document/Software/UserGuide/Firmware/DSM/4.0/enu/Syno_UsersGuide_NAServer_enu.pdf#page=14 | Under Account, you can change your account's password and description.
User Authentication / Authentication | Basic | CRIS 2 Basic (2): DSM uses local username/password login, while physical RESET can clear the administrator password without the old credential. This does not meet the stronger recovery-protection expectation for Secure authentication. https://global.download.synology.com/download/Document/Software/UserGuide/Firmware/DSM/4.0/enu/Syno_UsersGuide_NAServer_enu.pdf#page=10 | Enter your user name and password, and click Login. https://global.download.synology.com/download/Document/Software/UserGuide/Firmware/DSM/4.0/enu/Syno_UsersGuide_NAServer_enu.pdf#page=161 | you can reset the password to blank and set a new password.
User Authentication / Brute-force protection | Exist | CRIS 1 Exist (1): the system can set a failed-login threshold and interval, then block the source IP. DSM, SSH, FTP and other supported services contribute to the count. WikiIoT asks whether the system can set a limit; the manual establishes this capability, without claiming it is enabled by default. https://global.download.synology.com/download/Document/Software/UserGuide/Firmware/DSM/4.0/enu/Syno_UsersGuide_NAServer_enu.pdf#page=50 | After enabling the service, an IP address will be blocked if it has too many failed login attempts.
User Authentication / Event logging | Access event logged | CRIS 1 Access event logged (1): the manual explicitly lists the Connection log, File Station log, FTP transfer log, WebDAV log and Windows file-service transfer log. Logs can be cleared and old entries rotate; immutable audit retention is not claimed. https://global.download.synology.com/download/Document/Software/UserGuide/Firmware/DSM/4.0/enu/Syno_UsersGuide_NAServer_enu.pdf#page=152 | Use the drop-down menu to view the System log, the Connection log, FTP file transfer log, File Station log, the WebDAV log, the Windows file service transfer log
User Authentication / Passwords | Default/Common/Easy to guess | CRIS 3 Default/Common/Easy to guess (3): the DSM 4.0 manual explicitly states that the default admin password is empty. Password-strength rules are optional settings (p.57); they do not turn the documented initial blank password into a mandatory strong password. https://global.download.synology.com/download/Document/Software/UserGuide/Firmware/DSM/4.0/enu/Syno_UsersGuide_NAServer_enu.pdf#page=10 | The default password for admin is empty. https://global.download.synology.com/download/Document/Software/UserGuide/Firmware/DSM/4.0/enu/Syno_UsersGuide_NAServer_enu.pdf#page=57 | You can enable password strength service
