Synology DiskStation (DS3622xs+)

{{Classification |name=Synology DiskStation DS3622xs+ |brand=Synology |website=https://www.synology.com/en-global/support/download/DS3622xs%2B |release_date=2021-09-14 |generation=xs series |model=DS3622xs+ |type=NAS |status=In sale |dimensions=166 × 300 × 340 mm (H × W × D) |mass=7.5 kg |operating_system=Synology DSM; assessment: DSM 7.2.2-72806 Update 10 |companion_app=DS finder (Android/iOS); DSM web interface |cpu=Intel Xeon D-1531; 6 cores / 12 threads; 2.2 GHz |memory=16 GB DDR4 ECC RDIMM; expandable to 64 GB |storage=12 × SATA HDD/SSD bays; drives sold separately; 2 × M.2 2280 NVMe slots |power=100–240 V AC; 50/60 Hz; redundant power supply |display=Status LEDs |sound=System notification buzzer |connectivity=4 × 1GbE RJ-45; 2 × 10GbE RJ-45; 2 × USB 3.2 Gen 1; 1 × expansion port; PCIe Gen3 x8 |device_known_hardware_tampering=Rare |device_known_hardware_tampering_proof=[[1](https://kb.synology.com/en-global/DSM/tutorial/How_to_reset_my_Synology_NAS_7)] [[2](https://global.download.synology.com/download/Document/Hardware/DataSheet/DiskStation/21-year/DS3622xs%2B/enu/Synology_DS3622xs_Plus_Data_Sheet_enu.pdf)] |device_known_hardware_tampering_comment=Even this high-end 12-bay xs-series flagship lacks dedicated hardware tamper protection; physical access enables system reset and drive removal, with risks confined to controlled data center environments. |device_known_vulnerabilties=Rare |device_known_vulnerabilties_proof=[[3](https://www.synology.com/en-global/security/advisory/Synology_SA_24_20)] |device_known_vulnerabilties_comment=Historical DSM platform vulnerabilities have been documented and patched; the enterprise-grade firmware build includes all fixes from the referenced security advisory. |device_prior_attacks=Rare |device_prior_attacks_proof=[[4](https://www.synology.com/en-global/company/news/article/BruteForce)] |device_prior_attacks_comment=The 2021 brute-force campaign targeted consumer and small business DSM devices broadly; this enterprise-focused flagship model is not named as a confirmed victim in available documentation. |device_updatability=Very common |device_updatability_proof=[[5](https://www.synology.com/en-global/releaseNote/DSM?model=DS3622xs%2B)] [[6](https://www.synology.com/en-global/products/status)] |device_updatability_comment=As a premium xs-series enterprise model, it receives priority long-term DSM support with frequent security and maintenance updates. |system_authentication_with_other_systems=Partial |system_authentication_with_other_systems_proof=[[7](https://kb.synology.com/en-us/DSM/help/DSM/AdminCenter/file_share_privilege_nfs?version=7)] |system_authentication_with_other_systems_comment=The assessed NFS configuration uses AUTH_SYS client identity validation; full Kerberos mutual cryptographic authentication is not enabled in this specific profile. |system_communications=No encryption |system_communications_proof=[[8](https://global.download.synology.com/download/Document/Software/UserGuide/Os/DSM/7.2/enu/Syno_UsersGuide_NAServer_7_2_enu.pdf)] [[9](https://global.download.synology.com/download/Document/Hardware/DataSheet/DiskStation/21-year/DS3622xs%2B/enu/Synology_DS3622xs_Plus_Data_Sheet_enu.pdf)] |system_communications_comment=Unencrypted HTTP administration is active across all network interfaces (including 10GbE ports) in the test setup; optional HTTPS does not eliminate this plaintext management path. |system_storage=No encryption |system_storage_proof=[[10](https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/file_share_create?version=7)] [[11](https://global.download.synology.com/download/Document/Hardware/DataSheet/DiskStation/21-year/DS3622xs%2B/enu/Synology_DS3622xs_Plus_Data_Sheet_enu.pdf)] |system_storage_comment=User data across the 12-bay SATA array is unencrypted in this evaluation; enterprise-grade shared folder encryption is available but not activated for this assessment. |user_authentication_account_management=Full |user_authentication_account_management_proof=[[12](https://www.synology.com/en-global/dsm/7.2/software_spec/dsm)] |user_authentication_account_management_comment=DSM provides enterprise-grade identity and access management, including granular RBAC, group policies, account lifecycle control and centralized password enforcement. |user_authentication_authentication=Basic |user_authentication_authentication_proof=[[13](https://kb.synology.com/en-global/DSM/tutorial/How_to_reset_my_Synology_NAS_7)] [[14](https://global.download.synology.com/download/Document/Software/UserGuide/Os/DSM/7.2/enu/Syno_UsersGuide_NAServer_7_2_enu.pdf)] |user_authentication_authentication_comment=This assessment covers password-only local login; despite the enterprise hardware, the absence of MFA and presence of physical reset limit the rating to Basic. |user_authentication_brute_force_protection=Exist |user_authentication_brute_force_protection_proof=[[15](https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/connection_security_protection?version=7)] [[16](https://global.download.synology.com/download/Document/Hardware/DataSheet/DiskStation/21-year/DS3622xs%2B/enu/Synology_DS3622xs_Plus_Data_Sheet_enu.pdf)] |user_authentication_brute_force_protection_comment=Auto Block is configured to block source IP addresses after 5 failed login attempts within a 5-minute window across all network interfaces. |user_authentication_event_logging=Access event logged |user_authentication_event_logging_proof=[[17](https://kb.synology.com/en-global/DSM/help/DSM/MainMenu/security?version=7)] |user_authentication_event_logging_comment=All administrative login events are comprehensively logged with timestamps, access protocols and source IPs to support compliance and audit requirements. |user_authentication_passwords=Require change after setup with complexity requirements |user_authentication_passwords_proof=[[18](https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/file_user_advanced?version=7)] |user_authentication_passwords_comment=The enforced security policy mandates 12-character complex passwords and requires forced rotation for all temporary credentials issued by administrators. }} Documentation-driven security assessment for Synology DiskStation DS3622xs+, completed on 2026-10-24.

This 12-bay xs-series flagship NAS, powered by an Intel Xeon processor with dual 10GbE ports for small business and workgroup deployments, is evaluated against a specific DSM 7.2.2-72806 Update 10 configuration. The deployment uses local user accounts with password-only web administration, enables HTTP management access and an NFS AUTH_SYS file share on the corporate LAN. Supported internal SATA SSDs host an unencrypted shared data volume, with PCIe expansion and redundant power supplies present but not part of the security assessment scope. Auto Block brute-force protection is activated at 5 failed attempts within 5 minutes. Password policies enforce a 12-character minimum with mixed character sets, and all temporary admin passwords must be changed on initial login. Standard physical reset functionality remains enabled. All ratings apply solely to this documented configuration, and do not represent factory defaults or hands-on hardware testing.

Security ratings are mapped directly from published DSM specifications and the explicitly defined deployment profile. The "Rare" classification denotes a qualitative judgment of limited, well-defined risk exposure, not an empirically measured occurrence rate. Historical attack entries refer to platform-wide DSM incidents and do not confirm this enterprise model was specifically targeted; most documented campaigns focus on consumer and small-business deployments. The active HTTP plaintext management interface across all network ports is the basis for the "No encryption" communications rating. Storage ratings reflect only user data volume encryption status and do not assume encryption for system boot components. Optional enterprise security features are not treated as active unless explicitly included in the assessment scope. Historical CVE records do not imply vulnerability in the fully patched firmware build under review.

Release date reference: 2021-09-14, as stated in the official global English / Taipei launch announcement; this date is not claimed to be the earliest point of worldwide retail sale.

Historical vulnerabilities: CVE-2024-10441 (remote code execution), CVE-2024-50629 (limited file disclosure), CVE-2024-10445 (update certificate validation flaw). These affect DSM 7.2.2 prior to 7.2.2-72806 Update 1; Update 10 used in this assessment includes all corresponding patches.

No physical device was tested during this evaluation. All ratings must be interpreted within the stated configuration and supporting evidence scope.

DS3622xs+ official launch announcement DS3622xs+ official datasheet Synology product sales and support status DS3622xs+ DSM release history DSM 7.2 official user guide (PDF) Synology physical reset and its security effects Synology-SA-24:20 — DSM vulnerabilities and fixes Synology PSIRT — StealthWorker attacks, 2021-08-04 DSM NFS permissions — AUTH_SYS and Kerberos DSM shared-folder creation — optional encryption DSM 7.2 technical specifications — accounts and services DSM Auto Block — failed-login limits DSM personal security — login history DSM password strength and forced-change settings WikiIoT methodology