| Synology DiskStation DS925+ (DS925+)
|
|
Security Grade
Calculator v
|
Synology DiskStation DS925+
Release Date: 2025-04-23 • Status:
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Very common
|
🔗 Proof
|
An unauthenticated physical Mode 1 reset clears administrator credentials while retaining stored data; preserving the password requires an optional setting. Evidence boundary: Qualitative resistance rating based on the documented reset pathway, not incident prevalence. The specified unencrypted data remains accessible after account recovery.
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
DSM has documented login/API vulnerabilities; SA-26:13 identifies this assessed build as a fixed release. Evidence boundary: Known historical disclosures count; this does not call a fixed vulnerability currently open. Optional-package vulnerabilities are not automatically attributed to the base installation.
|
| Prior attacks
|
None
|
🔗 Proof
|
The bounded exact-model search identified research demonstrations, but no confirmed DS925+ botnet or in-the-wild campaign. Evidence boundary: Search-limited negative result as of 2026-10-23, not proof of no attacks. Generic older Synology campaigns and Pwn2Own demonstrations are not counted as exact-model wild incidents. Additional primary evidence: source 2.
|
| Updatability
|
Very common
|
🔗 Proof
|
Model-specific release notes and security advisories provide continuing DSM fixes, with automatic and manual update paths. Evidence boundary: The assessed maintained 7.3 branch is explicit; no claim it is the newest major version. Additional primary evidence: source 2.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
DSM checks account credentials, but the enabled HTTP management path supplies no TLS certificate verification of the server identity. Evidence boundary: Partial distinguishes account authentication from authenticated channel/server identity. HTTPS and directory certificate validation are available options rather than assumed deployment settings. Additional primary evidence: source 2.
|
| Communications
|
No encryption
|
🔗 Proof
|
HTTP and HTTPS management coexist; without optional redirection the HTTP application path remains unencrypted. Evidence boundary: Least-protected enabled application path. This does not claim HTTPS or every file-transfer protocol lacks encryption.
|
| Storage
|
No encryption
|
🔗 Proof
|
The specified compatible SATA SSDs store the data volume in flash; volume and folder encryption are deliberately unselected in this documented configuration. Evidence boundary: Configuration-specific application-data rating, not an assertion that every boot chip or every DS925+ is plaintext. Optional AES volume encryption would change the scope and rating. Additional primary evidence: source 2; source 3.
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
🔗 Proof
|
DSM supports multiple named accounts, groups and per-folder/application permissions with account lifecycle controls. Additional primary evidence: source 2.
|
| Authentication
|
Basic
|
🔗 Proof
|
Account authentication exists, but the default physical recovery route resets administrator credentials and disables its two-factor setting. Evidence boundary: Recovery integrity, rather than absence of compulsory MFA, motivates Basic. The optional preserve-password reset setting is outside this normal configuration. Additional primary evidence: source 2.
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
Auto Block and Account Protection are enabled in this specified configuration. Configurable failed-login blocking exists, while SMB Auto Block covers only public IP sources; the overall mapping is Basic. Evidence boundary: Documented configured protection with partial SMB coverage; neither factory-default enablement nor a hands-on lockout test is claimed. Additional primary evidence: source 2.
|
| Event logging
|
Access event logged
|
🔗 Proof
|
DSM records account login history and IP addresses; Log Center centralizes local system and connection events. Evidence boundary: Login access evidence, not an immutable record of every file action. Extra transfer logging and remote archives are not silently enabled. Additional primary evidence: source 2; source 3.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
The specified administrator uses a unique initial password. This meets the methodology first-setup goal through the disclosed option-2 mapping. An administrator-reset next-login-change workflow is not used as proof that every initial setup forces a later change. Evidence boundary: The form has no exact choice for unique first-use credential creation. Enforced complexity sufficient for option 1 is not credited here. Interpretation: Under the methodology prose about first-setup credentials, unique initial credentials are mapped to option 2. This does not assert forced later rotation or that the label is a literal description of every workflow. Additional primary evidence: source 2.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
(Companion App: )
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: • Power: • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity:
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
Assessment scope
Document-based deployment specification, not a physical test: DS925+ with two internal compatible SAT5220-3840G SATA SSDs (3.84 TB each), DSM 7.3.2-86009 Update 4 and SMB Service 4.15.13-4209. A normal Btrfs volume and shared folder are created without selecting optional encryption. HTTP management remains enabled without optional HTTPS redirection. No optional PHP/web-server, MailPlus or directory-server package is assumed. This is a stated supported configuration, not a claim about every DS925+ installation or the newest DSM branch. Auto Block and Account Protection are explicitly enabled with administrator-selected nonzero attempt/time thresholds; this is a documentary configuration, not a claim about fresh-install defaults. A unique administrator password is configured.
Method and evidence boundaries
This is a documentary case-study assessment of the exact hardware, firmware and explicitly stated configuration, reviewed on 24 October 2026. No physical installation, penetration test or traffic capture by the author is claimed. Historical flaws do not establish current unpatched exposure. The website supplies qualitative categories rather than statistical thresholds: repeated real maintenance supports Updatability 1; isolated/uncertain maintenance supports2; a documented no-update condition supports3. Vulnerability/attack frequency labels are reasoned judgments, and a laboratory demonstration is not an observed campaign. None for prior attacks means no exact-model field campaign established in the reviewed sources, not proof of lifetime absence. Communications follows the least-protected enabled path carrying control, credentials or application payloads; a DNS/discovery packet alone is not used to label an entire device unencrypted. Storage evaluates confidential device-resident flash contents, not merely cloud security or whether executable firmware is readable. For Passwords, the methodology discusses first-setup credentials and expressly allows unique initial passwords. Where mandatory first-use creation or explicitly configured unique credentials do not match a shared-default-change label literally, option2 is a disclosed functional mapping, not a claim of forced periodic rotation. Option1 additionally requires enforced complexity; option3 requires positive evidence of common, predictable or unprotected access. Dates preserve the identified manufacturer announcement/availability or clearly identified primary regional catalog basis. No arbitrary first-of-month date is inserted. The calculated IDRS device grade is not a manufacturer certification or a student assignment mark.
Calculated IDRS: 2 + 3 + 2 = 7 (C).
Date basis: Official German announcement states worldwide partner-channel availability from 23 April 2025.
Date source: https://www.synology.com/de-de/company/news/article/DS925p_DX525
Patch/support context: The specified maintained DSM 7.3.2 build fixes the cited historical login/API issue; optional packages and unrelated older NAS campaigns are not attributed to this exact deployment.
Product-specific boundaries: This is a documentary case study of the specified firmware and configuration, not an installed-device test. Frequency labels are qualitative assessments; no numerical frequency thresholds are supplied by the website. Prior-attacks None is a bounded exact-model search result and not proof of lifetime absence.
