Synology DiskStation DS920+

From Wiki-IoT
Revision as of 15:43, 21 October 2026 by Huixin Lin (talk | contribs) (Created page with "'''Evidence review: 2026-10-21. Overall IDRS grade: not assigned.''' All 12 criteria are investigated below. A documented capability, a historical vulnerability and an observ...")

(diff) ← Older revision | Approved revision (diff) | Latest revision (diff) | Newer revision → (diff)

Evidence review: 2026-10-21. Overall IDRS grade: not assigned.

All 12 criteria are investigated below. A documented capability, a historical vulnerability and an observed current configuration are different evidence types. Unresolved values are explicitly not scored; absence of a public report is not evidence of absence.

This page uses an evidence table because the current Classification calculator accepts only three scored choices and cannot represent unknown values safely. It does not change the shared template or assign an unsupported grade.

Product information

Field Verified value / stated scope
Name Synology DiskStation DS920+
Brand Synology
Model DS920+
Generation 2020 Plus Series
Release Date 2020-06-18
Operating System DSM 7.2.x capability baseline; individual installed build unknown.
Cpu Intel Celeron J4125, quad-core 2.0 GHz
Memory 4 GB DDR4; official maximum 8 GB
Storage 4 drive bays; installed drives and capacity unspecified
Connectivity Two Gigabit Ethernet ports
Companion App Depends on installed DSM packages
Type NAS
Website https://www.synology.com/en-me/company/news/article/Plus_20series
Dimensions 166 x 199 x 223 mm
Mass 2.24 kg

Assessment scope

DS920+ with DSM 7.2.x capability baseline; exact current model-specific build unknown. Conditional recommendations assume HTTPS, MFA, Auto Block and access logging enabled. Optional package vulnerabilities excluded unless installed.

No physical device, installed firmware, password, network trace or storage image was inspected. Conditional capability assessments apply only when the named settings are enabled.

Security evaluation

Device

Criterion Finding / rubric choice Evidence and reasoning
Known hardware tampering Physical reset and removable drives; not rated The DS920+ guide documents a reset button that restores network/admin settings, removable drive trays, and physical lock provisions. These establish local physical exposure, not attack-frequency statistics. DS920+ hardware installation guide
Known vulnerabilities Confirmed vulnerabilities; frequency not quantified The records below establish historical vulnerabilities within the stated firmware scope. They do not measure prevalence or establish a Rare/Very common frequency rating. Synology-SA-23:07 DSM Synology-SA-23:05 DSM
Prior attacks Synology platform campaign; DS920+ incidence unknown Synology documented StealthWorker brute-force attacks against weak administrator passwords in 2021 and warned of malware/ransomware and infected devices attacking others. The notice does not identify DS920+ victims or a model-specific rate. Synology StealthWorker response
Updatability Update mechanism verified; model-specific cadence unverified DSM 7.2 supports firmware updates, and general DSM notes show 2026 fixes. These do not independently establish the latest DS920+ build or a model-specific update-frequency label. DSM 7.2 guide DSM 7 general releases

System

Criterion Finding / rubric choice Evidence and reasoning
Authentication with other systems Not rated: insufficient evidence Authenticated services exist; guest-service settings and complete mutual authentication were not audited. DSM 7.2 specifications
Communications Encrypted with up-to-date encryption (CRIS 1; scoped assessment) Assumes HTTPS and encrypted supported transfers, with plaintext/legacy services disabled. DSM 7.2 specifications Synology security controls
Storage Not rated: insufficient evidence Encrypted user storage is supported; this does not prove all firmware-flash configuration is encrypted. The methodology refers specifically to device flash, not just user disks, removable media, or encrypted network traffic. DSM 7.2 specifications Synology security controls

User authentication

Criterion Finding / rubric choice Evidence and reasoning
Account management Full (CRIS 1; scoped assessment) Users, groups and privilege controls support least-privilege administration when configured. DSM 7.2 guide DSM 7.2 specifications
Authentication Basic recovery boundary; MFA available (CRIS 2; scoped assessment) DSM supports Secure SignIn/MFA. However, the hardware guide documents physical reset of administrator settings; an MFA-capable login alone does not establish secure recovery. Basic is a conservative assessment of this documented recovery boundary, not a claim that MFA is absent. DSM 7.2 guide DS920+ hardware installation guide
Brute-force protection Exist (CRIS 1; scoped assessment) Auto Block and Account Protection address repeated login attempts when enabled. DSM Auto Block and Account Protection
Event logging Access event logged (CRIS 1; scoped assessment) Log Center supports access/connection logging; relevant services and retention must be configured. DSM 7.2 specifications
Passwords Configurable forced change and complexity; active policy unknown DSM provides password-strength controls and options to require a password change after administrator reset or updated strength rules. These can support a strict configured baseline; they do not prove that every installation enables them or forces all first-use changes. DSM advanced password settings DSM 7.2 guide

Rating calculation

No definitive category score or GRAS is calculated while one or more required CRIS values are unresolved. The method requires taking the ceiling of each complete category mean and summing the three category scores. An unknown must not be substituted with 1 or treated as None. Wiki-IoT methodology

Historical vulnerabilities and remediation

CVE-2023-2729: Insufficient randomness in user management

  • Affected scope: DSM before 7.2-64561; relevant only to a susceptible installed DSM branch/build.
  • Preconditions: Remote attacker; extra vectors unspecified by vendor.
  • Impact: Possible user-credential disclosure.
  • Remediation: DSM 7.2-64561 or later; vendor says older listed branches will not fix this issue.
  • Severity: CVSS 3.1: 5.9, vendor.

CVE-2023-0142: Backup-management search-path weakness

  • Affected scope: DSM 7.1 before 7.1-42661, 7.0 before 7.0.1-42218-7, 6.2 before 6.2.4-25556-8; DSM 7.2 not affected.
  • Preconditions: Remote authenticated administrator.
  • Impact: Arbitrary file read/write, detailed vendor record.
  • Remediation: Branch-specific fixed builds above.
  • Severity: CVSS 3.1: 6.5, vendor.

Product evidence notes

Retrieved from "http://fehmijaafar.net/wiki-iot/index.php?title=Synology_DiskStation_DS920%2B&oldid=8651"