Synology RackStation RS2211+

CORRECTED EVIDENCE REVIEW (2026-10-23): PARTIAL HISTORICAL CLASSIFICATION: ELEVEN OF TWELVE CRITERIA RATED. The previous complete GRAS 8 / D or F assessment is withdrawn. The overconfident whole-device claims have been corrected. Six additional qualitative ratings are now supported by dated official DSM 4.0 sources and bounded explanations. The Storage criterion remains unscored because the cited manual does not establish encryption of data in device flash. This page is not a complete 12-criterion grade and no overall GRAS is asserted.

Product identity and source applicability

• Product: Synology RackStation RS2211+; manufacturer: Synology; type: NAS.
• Official launch/availability announcement date: 2011-03-29. Manufacturer announcement explicitly naming RS2211+
• Launch evidence: Taipei, Taiwan—March 29, 2011—Synology® Inc. today launched RackStation RS2211+ and RS2211RP+, 2U 10-bay rack mount NAS servers offering high-performance and rich business features to fulfill the rigorous demands of business users. Their expansion units, Synology RX1211 and RX1211RP, seamlessly scale up the storage space to 22 hard drives via InfiniBand cable that offers up to 12Gb/sec speed
• DSM 4.0 compatibility list explicitly names RS2211+ under Availability / Supported models include.
• DSM 4.3 compatibility list also explicitly names RS2211+.
• Historical scope: documented DSM 4.0 capabilities, with vulnerability applicability conditional on the stated unpatched software version. This does not establish the installed version or configuration of any physical unit, nor current support in 2026. Products originally shipped with earlier DSM releases.
• Platform manual applicability: the DSM 4.0 guide p.10 explicitly includes RackStation in the server-name explanation; the compatibility lists establish the named model/software relationship. A platform advisory is not an individual hardware-model incident report.

Audited evidence

Category	Criterion	Corrected rating/status	Facts and limits	Sources
Device	Known hardware tampering	Rare (2)	The DSM 4.0 manual documents a physical RESET button that clears the administrator password after four seconds (p.161). This is a documented physical-access recovery path; mapping it to Rare is a qualitative judgment, not a measured tampering frequency.	Source 1
Device	Known vulnerabilities	Very common (3)	The vendor confirms CVE-2013-6955 and CVE-2013-6987; CVE-2013-6955 applies to DSM 4.0 before 4.0-2259. Since the official DSM 4.0 compatibility list names this model, this establishes historical platform vulnerability exposure. Very common is a qualitative score for multiple documented vulnerabilities, not a per-unit incident count.	Source 1 Source 2 Source 3
Device	Prior attacks	Very common (3)	Synology confirmed attacks involving malicious processes and later SynoLocker ransomware affecting older DSM. The SynoLocker advisory explicitly names DSM 4.0-2257 or earlier; the DSM 4.0 compatibility list names this model. This is a qualitative platform-level prior-attack rating, not a claim that this hardware unit was infected or a per-model infection count.	Source 1 Source 2 Source 3 Source 4
Device	Updatability	Very common (1)	Official DSM 4.0 (2012) and DSM 4.3 (2013) release notices name this model as supported; Synology also published the 2014 DSM 4.0 security fix. Multiple releases/fixes in the historical assessment period support a qualitative frequent-updates score. This does not claim support continues in 2026.	Source 1 Source 2 Source 3
System	Authentication with other systems	Partial (2)	DSM 4.0 iSCSI documentation (p.34) supports single CHAP, where the server verifies the client, and Mutual CHAP, where both sides authenticate. Because the documented system offers both one-way and mutual-authentication modes, Partial is the bounded qualitative rating. This assesses the documented iSCSI feature, not every protocol or an inspected configuration.	Source 1
System	Communications	Encrypted with obsolete encryption (2)	The DSM 4.0 manual documents HTTP management and separately optional HTTPS/SSL-TLS (pp.10,17). Therefore this software supports both unencrypted HTTP and an encrypted management option; the chosen middle category describes mixed available modes, not all traffic or the active configuration of a physical unit. The cited legacy manual does not establish modern cipher strength.	Source 1
System	Storage	Not rated	The WikiIoT methodology explicitly concerns data in device flash. Guide p.63 concerns hard-drive shared folders, supports AES-256 folder encryption, and excludes certain service folders. Hard-drive folders are not proof of flash encryption. Previous No encryption / score 3 withdrawn; flash encryption is unverified.	Source 1
User Authentication	Account management	Full (1)	Full (1): the manual documents creating restricted user accounts (p.56), deleting users (p.57), changing passwords (p.14), and administrator versus ordinary groups (p.59). These are account-management capabilities, not assumptions about an inspected unit.	Source 1 Source 2 Source 3
User Authentication	Authentication	Basic (2)	Basic (2): DSM uses local username/password login, while physical RESET can clear the administrator password without the old credential. This does not meet the stronger recovery-protection expectation for Secure authentication.	Source 1 Source 2
User Authentication	Brute-force protection	Exist (1)	Exist (1): the system can set a failed-login threshold and interval, then block the source IP. DSM, SSH, FTP and other supported services contribute to the count. WikiIoT asks whether the system can set a limit; the manual establishes this capability, without claiming it is enabled by default.	Source 1
User Authentication	Event logging	Access event logged (1)	Access event logged (1): the manual explicitly lists the Connection log, File Station log, FTP transfer log, WebDAV log and Windows file-service transfer log. Logs can be cleared and old entries rotate; immutable audit retention is not claimed.	Source 1
User Authentication	Passwords	Default/Common/Easy to guess (3)	Default/Common/Easy to guess (3): the DSM 4.0 manual explicitly states that the default admin password is empty. Password-strength rules are optional settings (p.57); they do not turn the documented initial blank password into a mandatory strong password.	Source 1 Source 2

Grading status

• Eleven of twelve criteria now have explained ratings. Storage remains unrated because the available manual evidence concerns hard-drive shared folders, while WikiIoT defines Storage as data in device flash. No overall GRAS or letter grade is asserted while that criterion is unresolved.
• Unrated does not mean None, zero risk, or an assumed middle score of 2.
• Methodology defines Storage as device flash, not hard-drive shared folders. The cited evidence does not establish a defensible flash-encryption rating; the standard Classification template is not invoked while this criterion remains unresolved.
• Each source is an independent ordinary hyperlink. Closing link-formatting brackets are not part of any target URL.