Synology DiskStation (DS923+)

From Wiki-IoT
Revision as of 13:32, 24 October 2026 by Bohuai Pang (talk | contribs) (Documented security analysis for the mainstream 4-bay DS923+ NAS, covering patched DSM status, SOHO configuration and historical platform vulnerability records.)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

{{Classification |name=Synology DiskStation DS923+ |brand=Synology |website=https://www.synology.com/en-global/support/download/DS923%2B |release_date=2022-09-27 |generation=plus series |model=DS923+ |type=NAS |status=In sale |dimensions=166 × 199 × 223 mm (H × W × D) |mass=2.24 kg |operating_system=Synology DSM; assessment: DSM 7.2.2-72806 Update 10 |companion_app=DS finder (Android/iOS); DSM web interface |cpu=AMD Ryzen R1600; 2 cores / 4 threads; boost up to 3.1 GHz |memory=4 GB DDR4 ECC SODIMM; expandable to 32 GB |storage=4 × SATA HDD/SSD bays; drives sold separately; 2 × M.2 2280 NVMe slots |power=100–240 V AC; 50/60 Hz |display=Status LEDs |sound=System notification buzzer |connectivity=2 × 1GbE RJ-45; 2 × USB 3.2 Gen 1; 1 × eSATA; optional 10GbE upgrade module |device_known_hardware_tampering=Rare |device_known_hardware_tampering_proof=[[1](https://kb.synology.com/en-global/DSM/tutorial/How_to_reset_my_Synology_NAS_7)] [[2](https://global.download.synology.com/download/Document/Hardware/DataSheet/DiskStation/22-year/DS923%2B/enu/Synology_DS923%2B_Data_Sheet_enu.pdf)] |device_known_hardware_tampering_comment=This 4-bay mainstream model supports drive hot-swap and physical reset; tampering risks remain limited to scenarios with direct physical access to the device. |device_known_vulnerabilties=Rare |device_known_vulnerabilties_proof=[[3](https://www.synology.com/en-global/security/advisory/Synology_SA_24_20)] |device_known_vulnerabilties_comment=Historical DSM platform vulnerabilities have been documented and patched; the assessed firmware build includes all fixes from the referenced security advisory. |device_prior_attacks=Rare |device_prior_attacks_proof=[[4](https://www.synology.com/en-global/company/news/article/BruteForce)] |device_prior_attacks_comment=The 2021 platform-wide brute-force campaign predates this model's 2022 launch; there is no public record confirming this specific model was targeted in that event. |device_updatability=Very common |device_updatability_proof=[[5](https://www.synology.com/en-global/releaseNote/DSM?model=DS923%2B)] [[6](https://www.synology.com/en-global/products/status)] |device_updatability_comment=As a popular current-generation plus-series model, it receives consistent DSM maintenance and security updates through 2025–2026 per official release logs. |system_authentication_with_other_systems=Partial |system_authentication_with_other_systems_proof=[[7](https://kb.synology.com/en-us/DSM/help/DSM/AdminCenter/file_share_privilege_nfs?version=7)] |system_authentication_with_other_systems_comment=The evaluated NFS share relies on AUTH_SYS client UID/GID validation; Kerberos mutual cryptographic authentication is not enabled in this configuration. |system_communications=No encryption |system_communications_proof=[[8](https://global.download.synology.com/download/Document/Software/UserGuide/Os/DSM/7.2/enu/Syno_UsersGuide_NAServer_7_2_enu.pdf)] [[9](https://global.download.synology.com/download/Document/Hardware/DataSheet/DiskStation/22-year/DS923%2B/enu/Synology_DS923%2B_Data_Sheet_enu.pdf)] |system_communications_comment=Unencrypted HTTP administration is active on both network interfaces in the test profile; optional HTTPS support does not eliminate this plaintext attack surface. |system_storage=No encryption |system_storage_proof=[[10](https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/file_share_create?version=7)] [[11](https://global.download.synology.com/download/Document/Hardware/DataSheet/DiskStation/22-year/DS923%2B/enu/Synology_DS923%2B_Data_Sheet_enu.pdf)] |system_storage_comment=User data stored on internal SATA SSDs is unencrypted in this assessment; built-in shared folder encryption features are available but not activated. |user_authentication_account_management=Full |user_authentication_account_management_proof=[[12](https://www.synology.com/en-global/dsm/7.2/software_spec/dsm)] |user_authentication_account_management_comment=DSM natively supports full identity and access management on this model, including role-based permissions, account lifecycle operations and centralized password policies. |user_authentication_authentication=Basic |user_authentication_authentication_proof=[[13](https://kb.synology.com/en-global/DSM/tutorial/How_to_reset_my_Synology_NAS_7)] [[14](https://global.download.synology.com/download/Document/Software/UserGuide/Os/DSM/7.2/enu/Syno_UsersGuide_NAServer_7_2_enu.pdf) |user_authentication_authentication_comment=This evaluation covers password-only local login; without multi-factor authentication enabled and with physical reset functionality present, the rating is capped at Basic. |user_authentication_brute_force_protection=Absent |user_authentication_brute_force_protection_proof=[[15](https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/connection_security_protection?version=7)] [[16](https://global.download.synology.com/download/Document/Hardware/DataSheet/DiskStation/22-year/DS923%2B/enu/Synology_DS923%2B_Data_Sheet_enu.pdf)] |user_authentication_brute_force_protection_comment=Auto Block is configured to block source IP addresses after 5 failed login attempts within a 5-minute window in the assessed setup. |user_authentication_event_logging=Access event logged |user_authentication_event_logging_proof=[[17](https://kb.synology.com/en-global/DSM/help/DSM/MainMenu/security?version=7)] |user_authentication_event_logging_comment=All login sessions are recorded with timestamps, access protocols and source IP addresses, providing a complete audit trail for administrative access. |user_authentication_passwords=Require change after setup with complexity requirements |user_authentication_passwords_proof=[[18](https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/file_user_advanced?version=7)] |user_authentication_passwords_comment=The enforced policy mandates 12-character minimum passwords with mixed case and digits, plus forced reset for all administrator-issued temporary credentials. }} Documentation-driven security assessment for Synology DiskStation DS923+, completed on 2026-10-24.

This mainstream 4-bay plus-series NAS, widely used for home media storage and small office collaboration, is evaluated against a predefined DSM 7.2.2-72806 Update 10 configuration. The deployment uses native local user accounts with password-only web administration, enables HTTP management access and an NFS AUTH_SYS file share on the local area network. Supported internal SATA SSDs (with M.2 NVMe cache slots unused in this profile) host an unencrypted shared data volume for general file storage. Auto Block brute-force mitigation is activated with a threshold of 5 failed attempts in 5 minutes. Password rules enforce a minimum of 12 characters with mixed case and numeric characters, and temporary passwords set by administrators must be changed on first login. Standard physical reset functionality is retained. All ratings apply exclusively to this documented configuration, and do not represent factory default settings or hands-on hardware testing.

All security classifications are mapped from official DSM specifications and the explicitly defined deployment profile above. The "Rare" rating represents a qualitative judgment of bounded, well-documented risk exposure, rather than a statistically measured frequency of real-world incidents. Historical attack records refer to platform-wide DSM events and do not confirm this specific model as a confirmed target; the referenced 2021 campaign occurred before this device was released. The presence of an unencrypted HTTP management channel forms the basis for the "No encryption" communications rating. Storage ratings reflect only user data volume encryption status and do not make assumptions about system boot partition security. Optional security features are not counted as enabled unless explicitly included in the assessment scope. Historical CVE entries do not indicate ongoing vulnerability in the fully patched firmware build under review.

Release date reference: 2022-09-27, taken from the official global English / Taipei launch announcement; this date is not claimed to be the earliest point of worldwide retail availability.

Historical vulnerabilities referenced: CVE-2024-10441 (remote code execution), CVE-2024-50629 (limited file disclosure), CVE-2024-10445 (update certificate validation weakness). These issues affect DSM 7.2.2 versions prior to 7.2.2-72806 Update 1; Update 10 used in this assessment includes all corresponding security patches.

No physical device was tested during this evaluation. All security ratings must be interpreted within the stated configuration and supporting evidence boundaries.

DS923+ official launch announcement DS923+ official datasheet Synology product sales and support status DS923+ DSM release history DSM 7.2 official user guide (PDF) Synology physical reset and its security effects Synology-SA-24:20 — DSM vulnerabilities and fixes Synology PSIRT — StealthWorker attacks, 2021-08-04 DSM NFS permissions — AUTH_SYS and Kerberos DSM shared-folder creation — optional encryption DSM 7.2 technical specifications — accounts and services DSM Auto Block — failed-login limits DSM personal security — login history DSM password strength and forced-change settings WikiIoT methodology

Retrieved from "http://fehmijaafar.net/wiki-iot/index.php?title=Synology_DiskStation_(DS923%2B)&oldid=9702"