Synology DiskStation (DS224+)

{{Classification |name=Synology DiskStation DS224+ |brand=Synology |website=[1](https://www.synology.com/en-global/support/download/DS224%2B) |release_date=2024-01-23 |generation=plus series |model=DS224+ |type=NAS |status=In sale |dimensions=165 × 108 × 232.7 mm (H × W × D) |mass=1.29 kg |operating_system=Synology DSM; assessment: DSM 7.2.2-72806 Update 10 |companion_app=DS finder (Android/iOS); DSM web interface |cpu=Intel Celeron N4505; 2 cores / 2 threads; boost up to 2.9 GHz |memory=2 GB DDR4 non-ECC; expandable to 18 GB |storage=2 × SATA HDD/SSD bays; drives sold separately; 1 × M.2 2280 NVMe slot |power=100–240 V AC; 50/60 Hz |display=Status LEDs |sound=System notification buzzer |connectivity=2 × 1GbE RJ-45; 2 × USB 3.2 Gen 1 |device_known_hardware_tampering=Rare |device_known_hardware_tampering_proof=[[2](https://kb.synology.com/en-global/DSM/tutorial/How_to_reset_my_Synology_NAS_7)] [[3](https://global.download.synology.com/download/Document/Hardware/DataSheet/DiskStation/24-year/DS224%2B/enu/Synology_DS224%2B_Data_Sheet_enu.pdf)] |device_known_hardware_tampering_comment=As a recent 2-bay plus model, physical access enables system reset and drive removal; tampering threats are confined to on-site hands-on scenarios with no dedicated hardware protection. |device_known_vulnerabilties=Rare |device_known_vulnerabilties_proof=[[4](https://www.synology.com/en-global/security/advisory/Synology_SA_24_20)] |device_known_vulnerabilties_comment=The referenced DSM security flaws were disclosed and patched before this model launched; the factory-shipped firmware baseline already includes relevant fixes. |device_prior_attacks=Rare |device_prior_attacks_proof=[[5](https://www.synology.com/en-global/company/news/article/BruteForce)] |device_prior_attacks_comment=All documented historical DSM attack campaigns predate this 2024 model's release; there is no evidence linking this specific device to known real-world exploitation events. |device_updatability=Very common |device_updatability_proof=[[6](https://www.synology.com/en-global/releaseNote/DSM?model=DS224%2B)] [[7](https://www.synology.com/en-global/products/status)] |device_updatability_comment=As a newly released current-generation model, it is fully supported with active DSM security updates and maintenance patches per Synology's product lifecycle policy. |system_authentication_with_other_systems=Partial |system_authentication_with_other_systems_proof=[[8](https://kb.synology.com/en-us/DSM/help/DSM/AdminCenter/file_share_privilege_nfs?version=7)] |system_authentication_with_other_systems_comment=NFS access in this profile uses AUTH_SYS trust based on client user identities; stronger mutual authentication mechanisms are not part of the assessed setup. |system_communications=No encryption |system_communications_proof=[[9](https://global.download.synology.com/download/Document/Software/UserGuide/Os/DSM/7.2/enu/Syno_UsersGuide_NAServer_7_2_enu.pdf)] [[10](https://global.download.synology.com/download/Document/Hardware/DataSheet/DiskStation/24-year/DS224%2B/enu/Synology_DS224%2B_Data_Sheet_enu.pdf)] |system_communications_comment=Plain HTTP management is enabled by default in the test configuration; even with dual network ports, the unencrypted web interface remains an open attack vector. |system_storage=No encryption |system_storage_proof=[[11](https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/file_share_create?version=7)] [[12](https://global.download.synology.com/download/Document/Hardware/DataSheet/DiskStation/24-year/DS224%2B/enu/Synology_DS224%2B_Data_Sheet_enu.pdf)] |system_storage_comment=User data on the internal SATA drives is stored without encryption in this evaluation; DSM's optional folder-level encryption is not activated for this assessment profile. |user_authentication_account_management=Full |user_authentication_account_management_proof=[[13](https://www.synology.com/en-global/dsm/7.2/software_spec/dsm)] |user_authentication_account_management_comment=Despite its compact 2-bay form factor, DSM delivers complete account control including permission configuration, account deletion and password policy enforcement. |user_authentication_authentication=Basic |user_authentication_authentication_proof=[[14](https://kb.synology.com/en-global/DSM/tutorial/How_to_reset_my_Synology_NAS_7)] [[15](https://global.download.synology.com/download/Document/Software/UserGuide/Os/DSM/7.2/enu/Syno_UsersGuide_NAServer_7_2_enu.pdf)] |user_authentication_authentication_comment=This review focuses on standard password-based local authentication; the absence of MFA and presence of physical reset prevent a higher security rating. |user_authentication_brute_force_protection=Exist |user_authentication_brute_force_protection_proof=[[16](https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/connection_security_protection?version=7)] [[17](https://global.download.synology.com/download/Document/Hardware/DataSheet/DiskStation/24-year/DS224%2B/enu/Synology_DS224%2B_Data_Sheet_enu.pdf)] |user_authentication_brute_force_protection_comment=Auto Block is set to block IP addresses after 5 consecutive failed login attempts within a 5-minute period in this deployment. |user_authentication_event_logging=Access event logged |user_authentication_event_logging_proof=[[18](https://kb.synology.com/en-global/DSM/help/DSM/MainMenu/security?version=7)] |user_authentication_event_logging_comment=DSM records all sign-in events with detailed timestamp, protocol type and source IP address information via the built-in security log module. |user_authentication_passwords=Require change after setup with complexity requirements |user_authentication_passwords_proof=[[19](https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/file_user_advanced?version=7)] |user_authentication_passwords_comment=The active security policy enforces 12-character complex passwords and requires immediate change for all temporary credentials issued by the administrator. }} Security assessment based on official documentation for Synology DiskStation DS224+, reviewed 2026-10-24.

This compact 2-bay 2024 plus-series NAS, designed for upgraded home storage and light productivity use, is evaluated under a defined DSM 7.2.2-72806 Update 10 configuration. The setup employs local user accounts with password-only web access, enables HTTP administration and an NFS AUTH_SYS share on the home network, and runs an unencrypted shared data volume on supported internal SATA SSDs (with the single M.2 slot not utilized here). Auto Block protection is enabled to block brute-force login attempts after 5 failures in 5 minutes. A robust password policy is enforced: 12-character minimum with mixed case and digits, plus mandatory change for all admin-issued temporary passwords. Standard physical reset functionality is left enabled. All conclusions are specific to this documented configuration, and do not assert anything about factory default states or physical device testing.

Ratings are derived strictly from published DSM features and the explicitly defined assessment profile above. "Rare" is a qualitative assessment of known, constrained risk exposure, not a measurement of real-world attack frequency. Historical attack references apply to the broader DSM platform, and all documented campaigns occurred years before this model was brought to market. The active HTTP plaintext management interface is the determining factor for the no-encryption communication rating. Storage encryption status applies solely to user data volumes, with no inferences made about system boot partition or firmware encryption. Optional security capabilities are not considered enabled unless explicitly included in the evaluation scope. Past CVE records do not imply ongoing risk in the fully patched firmware version used here.

Release date scope: 2024-01-23, sourced from the official global English / Taipei launch announcement; this is not presented as the first date of worldwide retail availability.

Historical vulnerabilities referenced: CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445. These impact DSM 7.2.2 versions before 7.2.2-72806 Update 1; Update 10 deployed in this assessment contains all relevant fixes.

No physical hardware was tested for this evaluation. All security ratings must be read together with the stated configuration and evidence boundaries.

DS224+ official launch announcement DS224+ official datasheet Synology product sales and support status DS224+ DSM release history DSM 7.2 official user guide (PDF) Synology physical reset and its security effects Synology-SA-24:20 — DSM vulnerabilities and fixes Synology PSIRT — StealthWorker attacks, 2021-08-04 DSM NFS permissions — AUTH_SYS and Kerberos DSM shared-folder creation — optional encryption DSM 7.2 technical specifications — accounts and services DSM Auto Block — failed-login limits DSM personal security — login history DSM password strength and forced-change settings WikiIoT methodology