Synology DiskStation (DS920+)

From Wiki-IoT
Revision as of 16:39, 24 October 2026 by Bohuai Pang (talk | contribs) (Documented security analysis for the classic 4-bay DS920+ NAS, covering long-term patched DSM status, SOHO configuration and historical platform vulnerability records.)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

{{Classification |name=Synology DiskStation DS920+ |brand=Synology |website=https://www.synology.com/en-global/support/download/DS920%2B |release_date=2020-07-21 |generation=plus series |model=DS920+ |type=NAS |status=End of sale |dimensions=166 × 199 × 223 mm (H × W × D) |mass=2.24 kg |operating_system=Synology DSM; assessment: DSM 7.2.2-72806 Update 10 |companion_app=DS finder (Android/iOS); DSM web interface |cpu=Intel Celeron J4125; 4 cores / 4 threads; burst up to 2.7 GHz |memory=4 GB DDR4 non-ECC; expandable to 8 GB |storage=4 × SATA HDD/SSD bays; drives sold separately; 2 × M.2 2280 NVMe slots |power=100–240 V AC; 50/60 Hz |display=Status LEDs |sound=System notification buzzer |connectivity=2 × 1GbE RJ-45; 2 × USB 3.0; 1 × eSATA |device_known_hardware_tampering=Rare |device_known_hardware_tampering_proof=[[1](https://kb.synology.com/en-global/DSM/tutorial/How_to_reset_my_Synology_NAS_7)] [[2](https://global.download.synology.com/download/Document/Hardware/DataSheet/DiskStation/20-year/DS920%2B/enu/Synology_DS920%2B_Data_Sheet_enu.pdf)] |device_known_hardware_tampering_comment=This classic 4-bay plus model supports drive hot-swap and physical system reset; tampering risks are confined to scenarios with direct, unrestricted physical access to the chassis. |device_known_vulnerabilties=Rare |device_known_vulnerabilties_proof=[[3](https://www.synology.com/en-global/security/advisory/Synology_SA_24_20)] |device_known_vulnerabilties_comment=Multiple DSM security flaws have been disclosed and patched during this model's long lifecycle; the evaluated firmware build includes all fixes from the referenced 2024 advisory. |device_prior_attacks=Rare |device_prior_attacks_proof=[[4](https://www.synology.com/en-global/company/news/article/BruteForce)] |device_prior_attacks_comment=The 2021 StealthWorker brute-force campaign occurred shortly after this model launched, but public records only document platform-wide impact with no per-model victim confirmation. |device_updatability=Very common |device_updatability_proof=[[5](https://www.synology.com/en-global/releaseNote/DSM?model=DS920%2B)] [[6](https://www.synology.com/en-global/products/status)] |device_updatability_comment=As one of the most popular plus-series models, it continues to receive active DSM security and maintenance updates through 2026 despite being discontinued for sale. |system_authentication_with_other_systems=Partial |system_authentication_with_other_systems_proof=[[7](https://kb.synology.com/en-us/DSM/help/DSM/AdminCenter/file_share_privilege_nfs?version=7)] |system_authentication_with_other_systems_comment=The assessed NFS share relies on AUTH_SYS client UID/GID validation; Kerberos mutual cryptographic authentication is not enabled in this specific configuration. |system_communications=No encryption |system_communications_proof=[[8](https://global.download.synology.com/download/Document/Software/UserGuide/Os/DSM/7.2/enu/Syno_UsersGuide_NAServer_7_2_enu.pdf)] [[9](https://global.download.synology.com/download/Document/Hardware/DataSheet/DiskStation/20-year/DS920%2B/enu/Synology_DS920%2B_Data_Sheet_enu.pdf)] |system_communications_comment=Unencrypted HTTP administration is active on both network interfaces in the test profile; optional HTTPS support does not eliminate this plaintext attack surface. |system_storage=No encryption |system_storage_proof=[[10](https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/file_share_create?version=7)] [[11](https://global.download.synology.com/download/Document/Hardware/DataSheet/DiskStation/20-year/DS920%2B/enu/Synology_DS920%2B_Data_Sheet_enu.pdf)] |system_storage_comment=User data stored on internal SATA SSDs is unencrypted in this evaluation; built-in shared folder encryption features are available but not activated for this assessment. |user_authentication_account_management=Full |user_authentication_account_management_proof=[[12](https://www.synology.com/en-global/dsm/7.2/software_spec/dsm)] |user_authentication_account_management_comment=DSM natively supports full identity and access management on this model, including role-based permissions, account lifecycle operations and centralized password policies. |user_authentication_authentication=Basic |user_authentication_authentication_proof=[[13](https://kb.synology.com/en-global/DSM/tutorial/How_to_reset_my_Synology_NAS_7)] [[14](https://global.download.synology.com/download/Document/Software/UserGuide/Os/DSM/7.2/enu/Syno_UsersGuide_NAServer_7_2_enu.pdf)] |user_authentication_authentication_comment=This evaluation covers password-only local login; without multi-factor authentication enabled and with physical reset functionality present, the rating is capped at Basic. |user_authentication_brute_force_protection=Exist |user_authentication_brute_force_protection_proof=[[15](https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/connection_security_protection?version=7)] [[16](https://global.download.synology.com/download/Document/Hardware/DataSheet/DiskStation/20-year/DS920%2B/enu/Synology_DS920%2B_Data_Sheet_enu.pdf)] |user_authentication_brute_force_protection_comment=Auto Block is configured to block source IP addresses after 5 failed login attempts within a 5-minute window in the assessed setup. |user_authentication_event_logging=Access event logged |user_authentication_event_logging_proof=[[17](https://kb.synology.com/en-global/DSM/help/DSM/MainMenu/security?version=7)] |user_authentication_event_logging_comment=All login sessions are recorded with timestamps, access protocols and source IP addresses, providing a complete audit trail for administrative access. |user_authentication_passwords=Require change after setup with complexity requirements |user_authentication_passwords_proof=[[18](https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/file_user_advanced?version=7)] |user_authentication_passwords_comment=The enforced policy mandates 12-character minimum passwords with mixed case and digits, plus forced reset for all administrator-issued temporary credentials. }} Documentation-driven security assessment for Synology DiskStation DS920+, completed on 2026-10-24.

This widely adopted 4-bay plus-series NAS, a long-standing favorite for home media servers and small office file sharing, is evaluated against a predefined DSM 7.2.2-72806 Update 10 configuration. The deployment uses native local user accounts with password-only web administration, enables HTTP management access and an NFS AUTH_SYS file share on the local area network. Supported internal SATA SSDs (with dual M.2 NVMe cache slots unused in this profile) host an unencrypted shared data volume for general file storage. Auto Block brute-force mitigation is activated with a threshold of 5 failed attempts in 5 minutes. Password rules enforce a minimum of 12 characters with mixed case and numeric characters, and temporary passwords set by administrators must be changed on first login. Standard physical reset functionality is retained. All ratings apply exclusively to this documented configuration, and do not represent factory default settings or hands-on hardware testing.

All security classifications are mapped from official DSM specifications and the explicitly defined deployment profile above. The "Rare" rating represents a qualitative judgment of bounded, well-documented risk exposure, rather than a statistically measured frequency of real-world incidents. Historical attack records refer to platform-wide DSM events and do not confirm this specific model as a confirmed target; the referenced 2021 campaign occurred shortly after this device was released. The presence of an unencrypted HTTP management channel forms the basis for the "No encryption" communications rating. Storage ratings reflect only user data volume encryption status and do not make assumptions about system boot partition security. Optional security features are not counted as enabled unless explicitly included in the assessment scope. Historical CVE entries do not indicate ongoing vulnerability in the fully patched firmware build under review.

Release date reference: 2020-07-21, taken from the official global English / Taipei launch announcement; this date is not claimed to be the earliest point of worldwide retail availability.

Historical vulnerabilities referenced: CVE-2024-10441 (remote code execution), CVE-2024-50629 (limited file disclosure), CVE-2024-10445 (update certificate validation weakness). These issues affect DSM 7.2.2 versions prior to 7.2.2-72806 Update 1; Update 10 used in this assessment includes all corresponding security patches.

No physical device was tested during this evaluation. All security ratings must be interpreted within the stated configuration and supporting evidence boundaries.

DS920+ official launch announcement DS920+ official datasheet Synology product sales and support status DS920+ DSM release history DSM 7.2 official user guide (PDF) Synology physical reset and its security effects Synology-SA-24:20 — DSM vulnerabilities and fixes Synology PSIRT — StealthWorker attacks, 2021-08-04 DSM NFS permissions — AUTH_SYS and Kerberos DSM shared-folder creation — optional encryption DSM 7.2 technical specifications — accounts and services DSM Auto Block — failed-login limits DSM personal security — login history DSM password strength and forced-change settings WikiIoT methodology

Retrieved from "http://fehmijaafar.net/wiki-iot/index.php?title=Synology_DiskStation_(DS920%2B)&oldid=9815"