Synology DiskStation (DS423+)

From Wiki-IoT
Revision as of 15:50, 24 October 2026 by Bohuai Pang (talk | contribs) (Documented security review of the 4-bay DS423+ NAS, including patched DSM status, balanced SOHO configuration and platform vulnerability history.)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

{{Classification |name=Synology DiskStation DS423+ |brand=Synology |website=https://www.synology.com/en-global/support/download/DS423%2B |release_date=2023-05-17 |generation=plus series |model=DS423+ |type=NAS |status=In sale |dimensions=184 × 168 × 230 mm (H × W × D) |mass=2.23 kg |operating_system=Synology DSM; assessment: DSM 7.2.2-72806 Update 10 |companion_app=DS finder (Android/iOS); DSM web interface |cpu=Intel Celeron J4125; 4 cores / 4 threads; burst up to 2.7 GHz |memory=2 GB DDR4 non-ECC; expandable to 18 GB |storage=4 × SATA HDD/SSD bays; drives sold separately; 2 × M.2 2280 NVMe slots |power=100–240 V AC; 50/60 Hz |display=Status LEDs |sound=System notification buzzer |connectivity=2 × 1GbE RJ-45; 2 × USB 3.2 Gen 1 |device_known_hardware_tampering=Rare |device_known_hardware_tampering_proof=[[1](https://kb.synology.com/en-global/DSM/tutorial/How_to_reset_my_Synology_NAS_7)] [[2](https://global.download.synology.com/download/Document/Hardware/DataSheet/DiskStation/23-year/DS423%2B/enu/Synology_DS423%2B_Data_Sheet_enu.pdf)] |device_known_hardware_tampering_comment=This 4-bay current plus model has no dedicated tamper-proof hardware; physical access enables system reset and drive extraction, with risks limited to on-site scenarios. |device_known_vulnerabilties=Rare |device_known_vulnerabilties_proof=[[3](https://www.synology.com/en-global/security/advisory/Synology_SA_24_20)] |device_known_vulnerabilties_comment=The referenced 2024 DSM vulnerabilities were patched shortly after disclosure; the evaluated firmware build includes all corresponding security fixes. |device_prior_attacks=Rare |device_prior_attacks_proof=[[4](https://www.synology.com/en-global/company/news/article/BruteForce)] |device_prior_attacks_comment=All documented historical DSM attack campaigns predate this 2023 model's release; there is no public evidence linking this specific SKU to real-world exploitation events. |device_updatability=Very common |device_updatability_proof=[[5](https://www.synology.com/en-global/releaseNote/DSM?model=DS423%2B)] [[6](https://www.synology.com/en-global/products/status)] |device_updatability_comment=As an active current-generation model, it receives consistent DSM security updates and maintenance patches according to Synology's official support schedule. |system_authentication_with_other_systems=Partial |system_authentication_with_other_systems_proof=[[7](https://kb.synology.com/en-us/DSM/help/DSM/AdminCenter/file_share_privilege_nfs?version=7)] |system_authentication_with_other_systems_comment=NFS access in this profile uses AUTH_SYS trust based on client user identities; Kerberos mutual authentication is not enabled in the assessed configuration. |system_communications=No encryption |system_communications_proof=[[8](https://global.download.synology.com/download/Document/Software/UserGuide/Os/DSM/7.2/enu/Syno_UsersGuide_NAServer_7_2_enu.pdf)] [[9](https://global.download.synology.com/download/Document/Hardware/DataSheet/DiskStation/23-year/DS423%2B/enu/Synology_DS423%2B_Data_Sheet_enu.pdf)] |system_communications_comment=Plain HTTP web management is enabled in the test setup; even with dual network ports, the unencrypted interface remains an unaddressed attack surface in this profile. |system_storage=No encryption |system_storage_proof=[[10](https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/file_share_create?version=7)] [[11](https://global.download.synology.com/download/Document/Hardware/DataSheet/DiskStation/23-year/DS423%2B/enu/Synology_DS423%2B_Data_Sheet_enu.pdf)] |system_storage_comment=User data stored on internal SATA SSDs is unencrypted in this evaluation; DSM's built-in shared folder encryption feature is not activated for this setup. |user_authentication_account_management=Full |user_authentication_account_management_proof=[[12](https://www.synology.com/en-global/dsm/7.2/software_spec/dsm)] |user_authentication_account_management_comment=[/en-global/dsm/7.2/software_spec/dsm](https://www.synology.com/en-global/dsm/7.2/software_spec/dsm)]DSM supports complete user account management on this model, including permission assignment, account creation and deletion, and password policy enforcement. |user_authentication_authentication=Basic |user_authentication_authentication_proof=[[13](https://kb.synology.com/en-global/DSM/tutorial/How_to_reset_my_Synology_NAS_7)] [[14](https://global.download.synology.com/download/Document/Software/UserGuide/Os/DSM/7.2/enu/Syno_UsersGuide_NAServer_7_2_enu.pdf)] |user_authentication_authentication_comment=This review focuses on password-only local authentication; without multi-factor authentication and with physical reset available, the rating is capped at Basic. |user_authentication_brute_force_protection=Exist |user_authentication_brute_force_protection_proof=[[15](https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/connection_security_protection?version=7)] [[16](https://global.download.synology.com/download/Document/Hardware/DataSheet/DiskStation/23-year/DS423%2B/enu/Synology_DS423%2B_Data_Sheet_enu.pdf)] |user_authentication_brute_force_protection_comment=Auto Block is configured to trigger an IP block after 5 failed login attempts within a 5-minute monitoring window in this deployment. |user_authentication_event_logging=Access event logged |user_authentication_event_logging_proof=[[17](https://kb.synology.com/en-global/DSM/help/DSM/MainMenu/security?version=7)] |user_authentication_event_logging_comment=DSM records all login sessions with timestamps, protocol types and source IP addresses via the integrated security logging system. |user_authentication_passwords=Require change after setup with complexity requirements |user_authentication_passwords_proof=[[18](https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/file_user_advanced?version=7)] |user_authentication_passwords_comment=The active security policy mandates 12-character complex passwords and requires immediate change for all administrator-issued temporary credentials. }} Security assessment based on official documentation for Synology DiskStation DS423+, reviewed 2026-10-24.

This 4-bay 2023 plus-series NAS, positioned as a balanced upgrade for home and small office storage, is evaluated under a defined DSM 7.2.2-72806 Update 10 configuration. The setup employs local user accounts with password-only web access, enables HTTP administration and an NFS AUTH_SYS share on the local network, and hosts an unencrypted shared data volume on supported internal SATA SSDs with dual M.2 cache slots. Auto Block protection is enabled to block brute-force login attempts after 5 failures in 5 minutes. A strong password policy is in place: 12-character minimum with mixed case and numbers, plus mandatory change for all temporary passwords set by the admin. Standard physical reset functionality is retained. All conclusions are specific to this documented configuration, and do not represent factory default settings or physical device testing.

Security ratings are derived strictly from published DSM features and the explicitly defined profile above. The "Rare" classification is a qualitative judgment of limited known risk exposure, not a statistically measured frequency of real-world attacks. Historical attack references apply to the broader DSM platform, and all documented campaigns occurred before this model was launched. The active HTTP plaintext management interface is the basis for the "No encryption" communications rating. Storage ratings apply only to user data volumes, and no assumptions are made about boot partition encryption status. Optional security features are not considered enabled unless explicitly part of the assessment scope. Historical CVE records do not mean the fully patched firmware version in use remains vulnerable.

Release date scope: 2023-05-17, sourced from the official global English / Taipei launch announcement; this is not presented as the earliest date of worldwide retail availability.

Historical vulnerabilities referenced: CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445. These issues affect DSM 7.2.2 versions before 7.2.2-72806 Update 1; Update 10 used in this assessment includes all relevant security fixes.

No physical hardware was tested for this evaluation. All security ratings must be read alongside the stated configuration and evidence boundaries.

DS423+ official launch announcement DS423+ official datasheet Synology product sales and support status DS423+ DSM release history DSM 7.2 official user guide (PDF) Synology physical reset and its security effects Synology-SA-24:20 — DSM vulnerabilities and fixes Synology PSIRT — StealthWorker attacks, 2021-08-04 DSM NFS permissions — AUTH_SYS and Kerberos DSM shared-folder creation — optional encryption DSM 7.2 technical specifications — accounts and services DSM Auto Block — failed-login limits DSM personal security — login history DSM password strength and forced-change settings WikiIoT methodology

Retrieved from "http://fehmijaafar.net/wiki-iot/index.php?title=Synology_DiskStation_(DS423%2B)&oldid=9788"