Synology DiskStation DS423+ (DS423+)

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	[1] 🔗 Proof	Desktop four-bay NAS with removable drive trays, USB/network ports, a physical RESET button and a Kensington security slot. Tray locks and a cable lock deter casual removal but do not establish resistance to invasive hardware changes. Physical recovery can alter authentication settings. Rare is a qualitative partial-resistance mapping, not an observed incident rate.
Known vulnerabilities	Very common	[2] 🔗 Proof	Multiple DSM vulnerabilities are documented across releases. Example CVE-2026-13684: unauthenticated remote arbitrary-file read/write and denial of service, CVSS 3.1 9.8. Affected DSM branches are fixed at 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 or 7.4-90075 and later respectively. Apply the advisory only when the installed DSM version is affected. Very common rates recurring platform vulnerability history; it does not assert that a patched DS423+ is currently exploitable.
Prior attacks	Rare	🔗 Proof	Synology reported real StealthWorker credential-guessing attacks in August 2021. This predates this model and is NAS/platform threat history, not a claimed incident on DS423+. No exact-model in-the-wild incident was established in the reviewed material. Rare is a provisional device-class mapping; the site has no Unknown option.
Updatability	Very common	[3] 🔗 Proof	DSM supports official software updates and vendor security releases. Install the release offered for this exact model and supported branch; current security patches are an assessment condition. This documents an update mechanism and maintained security releases, not a guaranteed future support period.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	[4] 🔗 Proof	DSM provides account permissions and AD/LDAP integration, but authentication strength depends on each protocol and client. The reviewed evidence does not establish universal mutual authentication across every supported integration. Guest access is disabled in the assessed profile.
Communications	Encrypted with up-to-date encryption	[5] 🔗 Proof	Conditional on HTTPS with a validated certificate and TLS 1.2/1.3 for the assessed management/file-transfer paths. DSM provides configurable TLS profiles. HTTP and legacy plaintext protocols are also supported; encryption is not universal or automatically enabled for every service.
Storage	Encrypted with up-to-date encryption	[6] 🔗 Proof	DS423+ is explicitly listed for encrypted volumes with DSM 7.2+. The configured profile uses LUKS AES-XTS data-volume encryption. This covers volume contents, not all boot/system flash. Encryption must be selected; key-vault location, automatic unlocking and reset behavior affect physical protection. No claim of encrypted factory-default storage.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Full	[7] 🔗 Proof	DSM supports multiple named users, groups and application/file permissions. Use distinct least-privilege accounts; this is broader than one shared administrator account.
Authentication	Basic	[8] 🔗 Proof	Named password accounts and optional two-factor authentication are documented. Basic is conservative because 2FA is configurable and physical recovery can reset administrator/2FA settings unless additional protections are configured. This does not imply that DSM lacks 2FA.
Brute-force protection	Exist	[9] 🔗 Proof	Auto Block records failed sign-ins and can block source IPs after a configured threshold. It is enabled in the assessed profile, not assumed to be universal by default. Keep DSM patched: CVE-2026-40538 affected the Auto Block mechanism in older branches; SA-26:06 lists the fixed builds.
Event logging	Access event logged	[10] 🔗 Proof	DSM Login History records access time, protocol and source IP; Account Activity shows sessions, and Log Center can report failed sign-ins. This supports authentication/access logging, not guaranteed recording of every operation or tamper-proof retention.
Passwords	Require change after setup with complexity requirements	🔗 Proof	Conditional configured policy: apply password-strength rules and require replacement after provisioning/at next login. DSM supports length/character rules and forcing users to change existing passwords when applying rules. This is an explicitly configured deployment condition, not a claim that every factory installation enforces it.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Synology DSM 7.2+; patched configured profile (see scope) (Companion App: Synology Drive / Secure SignIn (optional))
Hardware (CPU / GPU)	CPU: Intel Celeron J4125 • GPU:
Memory & Storage	Memory: 2 GB DDR4; expandable to 6 GB • Storage: 4 SATA drive bays; drives and capacity depend on configuration
Power, Battery & Charging	Battery: • Power: 100-240 VAC, 50/60 Hz via supplied adapter • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: 2 x 1GbE RJ45; 2 x USB 3.2 Gen 1
Physical (Dimensions & Mass)	Dimensions: 166 x 199 x 223 mm (H x W x D) • Mass: 2.18 kg

Assessment scope

Documentation-based configured-deployment assessment dated 2026-10-23, not a factory-default or hands-on test. Scope: official supported DSM 7.2+ with current vendor security patches, named local accounts, HTTPS-only assessed management/file-transfer paths with a trusted certificate and TLS 1.2/1.3, encrypted data volumes, Auto Block enabled, and an administrator-configured password-strength policy with password replacement required after account provisioning. Unused plaintext services and guest access are disabled. These are explicit configuration conditions, not observations of a real installed unit. Hardware recovery remains possible; stronger reset-protection settings are not assumed. Storage scoring covers encrypted user-data volumes, not a claim that boot media, system partitions and every internal flash region are encrypted.

Device and physical boundary

A four-bay network-attached storage appliance for private-cloud file sharing, backup and optional IP-camera recording. DS423+ is the exact manufacturer model. This model has an Intel platform and 2 GB base RAM; it is distinct from the non-Plus DS423.

Desktop four-bay NAS with removable drive trays, USB/network ports, a physical RESET button and a Kensington security slot. Tray locks and a cable lock deter casual removal but do not establish resistance to invasive hardware changes. Physical recovery can alter authentication settings. Rare is a qualitative partial-resistance mapping, not an observed incident rate.

Stored documents, backups and camera recordings can be exposed by compromised accounts or unpatched services. Encryption does not stop an authenticated attacker from modifying unlocked files.

Vulnerabilities and attack attribution

Multiple DSM vulnerabilities are documented across releases. Example CVE-2026-13684: unauthenticated remote arbitrary-file read/write and denial of service, CVSS 3.1 9.8. Affected DSM branches are fixed at 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 or 7.4-90075 and later respectively. Apply the advisory only when the installed DSM version is affected. Very common rates recurring platform vulnerability history; it does not assert that a patched DS423+ is currently exploitable.

The two NAS models share DSM software evidence but have distinct hardware. Platform CVEs apply according to installed DSM/package versions, not merely the brand name. Optional package CVEs have not been represented as unconditional base-device vulnerabilities. SA-24:20 provides additional historical DSM security fixes.

Synology reported real StealthWorker credential-guessing attacks in August 2021. This predates this model and is NAS/platform threat history, not a claimed incident on DS423+. No exact-model in-the-wild incident was established in the reviewed material. Rare is a provisional device-class mapping; the site has no Unknown option.

Score and limits

CRIS vector: 2, 3, 2, 1, 2, 1, 1, 1, 2, 1, 1, 1. Category ceilings: [2, 2, 2]. Total 6; proposed conditional grade B. The identical grade for these two models reflects shared DSM controls, not independent tests. The assessment is for the stated configured paths and encrypted data volumes; it is not a whole-device factory-default certification. If the site requires all internal flash to be encrypted, Storage cannot be concluded from these volume documents and requires administrator review. Prior-attacks score is based on NAS-class history, with no verified incident attribution to this exact model.

Practical improvements

Keep DSM and installed packages current; disable unused services and guest access; restrict management to a trusted network or VPN; use strong unique passwords and 2FA; enable Auto Block, review login history and preserve off-device logs. Encrypt sensitive volumes, protect recovery keys separately, review reset/unlock settings, secure physical access and keep offline or immutable backups.

Release-date evidence

2023-03-15 is the manufacturer announcement date and stated same-day availability in the linked release. It identifies this exact model, not a retailer listing or a different hardware revision. Regional availability may vary.

Research and originality

Individual documentation review, 2026-10-23. No physical test, exploit attempt or measurement was performed. WikiIoT brand and model-term searches (DS423 and DS923) did not return existing exact-model entries at preparation time; pending/unindexed submissions cannot be ruled out.

Sources

• Manufacturer launch and availability
• Exact-model hardware and software datasheet
• Model-filtered DSM release notes
• reset
• cve
• old_cve
• brute_cve
• attacks
• tls
• encrypted_models
• volume
• users
• passwords
• signin
• block
• logs