Synology RackStation RS2211+

CORRECTED EVIDENCE REVIEW (2026-10-23): INCOMPLETE NUMERICAL CLASSIFICATION. The previous complete GRAS 8 / D or F assessment is withdrawn. Seven categorical scores were not strictly supported by the evidence; they are no longer asserted. Five historical user-authentication capability scores remain supported. This record must not be presented as a fully evidenced 12-criterion numerical classification.

Product identity and source applicability

• Product: Synology RackStation RS2211+; manufacturer: Synology; type: NAS.
• Official launch/availability announcement date: 2011-03-29. Manufacturer announcement explicitly naming RS2211+
• Launch evidence: Taipei, Taiwan—March 29, 2011—Synology® Inc. today launched RackStation RS2211+ and RS2211RP+, 2U 10-bay rack mount NAS servers offering high-performance and rich business features to fulfill the rigorous demands of business users. Their expansion units, Synology RX1211 and RX1211RP, seamlessly scale up the storage space to 22 hard drives via InfiniBand cable that offers up to 12Gb/sec speed
• DSM 4.0 compatibility list explicitly names RS2211+ under Availability / Supported models include.
• DSM 4.3 compatibility list also explicitly names RS2211+.
• Historical scope: documented DSM 4.0 capabilities, with vulnerability applicability conditional on the stated unpatched software version. This does not establish the installed version or configuration of any physical unit, nor current support in 2026. Products originally shipped with earlier DSM releases.
• Platform manual applicability: the DSM 4.0 guide p.10 explicitly includes RackStation in the server-name explanation; the compatibility lists establish the named model/software relationship. A platform advisory is not an individual hardware-model incident report.

Audited evidence

Category	Criterion	Corrected rating/status	Facts and limits	Sources
Device	Known hardware tampering	Not rated	The physical RESET procedure in DSM 4.0 clears an administrator password (guide p.161). This establishes a recovery behavior, not a measured frequency of hardware modifications. The previous Rare rating is withdrawn.	Source 1
Device	Known vulnerabilities	Not rated	CVE-2013-6955 affects DSM 4.0 before 4.0-2259. The vendor confirms this and CVE-2013-6987. Software vulnerability existence is established conditionally on the installed version, but neither source provides model-specific frequency supporting Very common. The previous score 3 is withdrawn.	Source 1 Source 2 Source 3
Device	Prior attacks	Not rated	Synology confirms SynoLocker attacks on older DSM systems, listing DSM 4.0-2257 or earlier among the symptom/version checks. No individual model infection count or frequency denominator is provided. The previous Very common rating is withdrawn; no infection of this specific model is asserted.	Source 1 Source 2 Source 3 Source 4
Device	Updatability	Not rated	DSM 4.0 and DSM 4.3 announcements explicitly list this model, and a 2014 vendor advisory recommends DSM 4.0-2259 security fixes. This proves historical updates existed, not current support or a quantified Rare/Very common frequency. The previous numerical score is withdrawn.	Source 1 Source 2 Source 3
System	Authentication with other systems	Not rated	DSM 4.0 guide p.34 documents optional single CHAP and Mutual CHAP. No actual device configuration was inspected. Selecting only single CHAP to assign a whole-product Partial rating was unjustified; that rating is withdrawn.	Source 1
System	Communications	Not rated	The DSM 4.0 guide documents HTTP management (p.10) and optional HTTPS with SSL/TLS (p.17). Available modes do not prove the active mode or encryption of all traffic. The whole-product No encryption rating and score 3 are withdrawn. See the same linked guide for both pages.	Source 1
System	Storage	Not rated	The WikiIoT methodology explicitly concerns data in device flash. Guide p.63 concerns hard-drive shared folders, supports AES-256 folder encryption, and excludes certain service folders. Hard-drive folders are not proof of flash encryption. Previous No encryption / score 3 withdrawn; flash encryption is unverified.	Source 1
User Authentication	Account management	Full (1)	Full (1): the manual documents creating restricted user accounts (p.56), deleting users (p.57), changing passwords (p.14), and administrator versus ordinary groups (p.59). These are account-management capabilities, not assumptions about an inspected unit.	Source 1 Source 2 Source 3
User Authentication	Authentication	Basic (2)	Basic (2): DSM uses local username/password login, while physical RESET can clear the administrator password without the old credential. This does not meet the stronger recovery-protection expectation for Secure authentication.	Source 1 Source 2
User Authentication	Brute-force protection	Exist (1)	Exist (1): the system can set a failed-login threshold and interval, then block the source IP. DSM, SSH, FTP and other supported services contribute to the count. WikiIoT asks whether the system can set a limit; the manual establishes this capability, without claiming it is enabled by default.	Source 1
User Authentication	Event logging	Access event logged (1)	Access event logged (1): the manual explicitly lists the Connection log, File Station log, FTP transfer log, WebDAV log and Windows file-service transfer log. Logs can be cleared and old entries rotate; immutable audit retention is not claimed.	Source 1
User Authentication	Passwords	Default/Common/Easy to guess (3)	Default/Common/Easy to guess (3): the DSM 4.0 manual explicitly states that the default admin password is empty. Password-strength rules are optional settings (p.57); they do not turn the documented initial blank password into a mandatory strong password.	Source 1 Source 2

Grading status

• No Device CATS, System CATS, overall GRAS, or letter grade is asserted while seven criteria remain unrated. Only the supported User Authentication subscore is calculable: ceil((1+2+1+1+3)/5)=2.
• Unrated does not mean None, zero risk, or an assumed middle score of 2. No Unknown option is invented for the standard form.
• Methodology defines Storage as device flash, not hard-drive shared folders. The standard Classification template is not invoked because its calculator does not safely represent unrated criteria.
• Each source is an independent ordinary hyperlink. Closing link-formatting brackets are not part of any target URL.