Synology DiskStation (DS220+)

{{Classification |name=Synology DiskStation DS220+ |brand=Synology |website=https://www.synology.com/en-global/support/download/DS220%2B |release_date=2020-07-21 |generation=plus series |model=DS220+ |type=NAS |status=End of sale |dimensions=165 × 108 × 232.7 mm (H × W × D) |mass=1.29 kg |operating_system=Synology DSM; assessment: DSM 7.2.2-72806 Update 10 |companion_app=DS finder (Android/iOS); DSM web interface |cpu=Intel Celeron J4025; 2 cores / 2 threads; burst up to 2.9 GHz |memory=2 GB DDR4 non-ECC; expandable to 6 GB |storage=2 × SATA HDD/SSD bays; drives sold separately; 1 × M.2 2280 NVMe slot |power=100–240 V AC; 50/60 Hz |display=Status LEDs |sound=System notification buzzer |connectivity=2 × 1GbE RJ-45; 2 × USB 3.0 |device_known_hardware_tampering=Rare |device_known_hardware_tampering_proof=[[1](https://kb.synology.com/en-global/DSM/tutorial/How_to_reset_my_Synology_NAS_7)] [[2](https://global.download.synology.com/download/Document/Hardware/DataSheet/DiskStation/20-year/DS220%2B/enu/Synology_DS220%2B_Data_Sheet_enu.pdf)] |device_known_hardware_tampering_comment=This entry-level 2-bay plus model has no dedicated hardware tamper protection; physical access enables system reset and drive removal, with risks limited to on-site hands-on scenarios. |device_known_vulnerabilties=Rare |device_known_vulnerabilties_proof=[[3](https://www.synology.com/en-global/security/advisory/Synology_SA_24_20)] |device_known_vulnerabilties_comment=Historical DSM platform vulnerabilities have been progressively patched over the product's lifecycle; the evaluated firmware build includes all relevant security fixes. |device_prior_attacks=Rare |device_prior_attacks_proof=[[4](https://www.synology.com/en-global/company/news/article/BruteForce)] |device_prior_attacks_comment=The 2021 brute-force campaign occurred shortly after this model launched, but available documentation only references platform-wide impact without model-specific attribution. |device_updatability=Very common |device_updatability_proof=[[5](https://www.synology.com/en-global/releaseNote/DSM?model=DS220%2B)] [[6](https://www.synology.com/en-global/products/status)] |device_updatability_comment=As a long-running popular 2-bay plus model, it continues to receive consistent DSM security updates and maintenance patches years after launch. |system_authentication_with_other_systems=Partial |system_authentication_with_other_systems_proof=[[7](https://kb.synology.com/en-us/DSM/help/DSM/AdminCenter/file_share_privilege_nfs?version=7)] |system_authentication_with_other_systems_comment=NFS shares in this profile use AUTH_SYS client identity trust; stronger mutual authentication via Kerberos is not part of the assessed configuration. |system_communications=No encryption |system_communications_proof=[[8](https://global.download.synology.com/download/Document/Software/UserGuide/Os/DSM/7.2/enu/Syno_UsersGuide_NAServer_7_2_enu.pdf)] [[9](https://global.download.synology.com/download/Document/Hardware/DataSheet/DiskStation/20-year/DS220%2B/enu/Synology_DS220%2B_Data_Sheet_enu.pdf)] |system_communications_comment=Plain HTTP web management is enabled in the test setup; even with dual network ports, the unencrypted interface remains an unmitigated attack surface. |system_storage=No encryption |system_storage_proof=[[10](https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/file_share_create?version=7)] [[11](https://global.download.synology.com/download/Document/Hardware/DataSheet/DiskStation/20-year/DS220%2B/enu/Synology_DS220%2B_Data_Sheet_enu.pdf)] |system_storage_comment=User data on internal SATA SSDs is stored without encryption in this evaluation; DSM's built-in folder encryption feature is not activated for this profile. |user_authentication_account_management=Full |user_authentication_account_management_proof=[[12](https://www.synology.com/en-global/dsm/7.2/software_spec/dsm)] |user_authentication_account_management_comment=DSM delivers complete user account management on this model, including permission settings, account creation and deletion, and password policy enforcement. |user_authentication_authentication=Basic |user_authentication_authentication_proof=[[13](https://kb.synology.com/en-global/DSM/tutorial/How_to_reset_my_Synology_NAS_7)] [[14](https://global.download.synology.com/download/Document/Software/UserGuide/Os/DSM/7.2/enu/Syno_UsersGuide_NAServer_7_2_enu.pdf)] |user_authentication_authentication_comment=This review examines password-only local authentication; without MFA enabled and with physical reset available, the rating cannot exceed Basic. |user_authentication_brute_force_protection=Exist |user_authentication_brute_force_protection_proof=[[15](https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/connection_security_protection?version=7)] [[16](https://global.download.synology.com/download/Document/Hardware/DataSheet/DiskStation/20-year/DS220%2B/enu/Synology_DS220%2B_Data_Sheet_enu.pdf)] |user_authentication_brute_force_protection_comment=The configured Auto Block rule triggers an IP ban after 5 unsuccessful login attempts within a 5-minute time window. |user_authentication_event_logging=Access event logged |user_authentication_event_logging_proof=[[17](https://kb.synology.com/en-global/DSM/help/DSM/MainMenu/security?version=7)] |user_authentication_event_logging_comment=DSM records all login sessions with timestamps, protocol details and source IP addresses via the integrated security logging function. |user_authentication_passwords=Require change after setup with complexity requirements |user_authentication_passwords_proof=[[18](https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/file_user_advanced?version=7)] |user_authentication_passwords_comment=The active security policy requires 12-character complex passwords and mandates immediate change for all administrator-issued temporary credentials. }} Security assessment based on official documentation for Synology DiskStation DS220+, reviewed 2026-10-24.

This compact 2-bay entry-level plus-series NAS, a popular upgrade option for home users seeking better performance than j-series models, is evaluated under a defined DSM 7.2.2-72806 Update 10 configuration. The setup employs local user accounts with password-only web access, enables HTTP administration and an NFS AUTH_SYS share on the home network, and hosts an unencrypted shared data volume on supported internal SATA SSDs with a single M.2 cache slot. Auto Block protection is enabled to block brute-force login attempts after 5 failures in 5 minutes. A strong password policy is in place: 12-character minimum with mixed case and numbers, plus mandatory change for all temporary passwords set by the admin. Standard physical reset functionality is retained. All conclusions are specific to this documented setup, and do not represent factory default configurations or physical device testing.

Security ratings are derived exclusively from published DSM features and the explicitly defined profile above. The "Rare" classification is a qualitative judgment of limited known risk exposure, not a statistically measured frequency of real-world attacks. Historical attack references apply to the DSM platform as a whole, and the 2021 referenced event occurred shortly after this device entered the market with no model-specific confirmation. The active HTTP plaintext management interface is the basis for the "No encryption" communications rating. Storage ratings apply only to user data volumes, and no assumptions are made about boot partition encryption status. Optional security features are not considered enabled unless explicitly part of the assessment scope. Historical CVE records do not mean the patched firmware version in use is still vulnerable.

Release date scope: 2020-07-21, taken from the official global English / Taipei launch announcement; this is not presented as the earliest date of worldwide retail availability.

Historical vulnerabilities referenced: CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445. These issues affect DSM 7.2.2 versions before 7.2.2-72806 Update 1; Update 10 used in this assessment includes all relevant fixes.

No physical hardware was tested for this evaluation. All security ratings must be read alongside the stated configuration and evidence boundaries.

DS220+ official launch announcement DS220+ official datasheet Synology product sales and support status DS220+ DSM release history DSM 7.2 official user guide (PDF) Synology physical reset and its security effects Synology-SA-24:20 — DSM vulnerabilities and fixes Synology PSIRT — StealthWorker attacks, 2021-08-04 DSM NFS permissions — AUTH_SYS and Kerberos DSM shared-folder creation — optional encryption DSM 7.2 technical specifications — accounts and services DSM Auto Block — failed-login limits DSM personal security — login history DSM password strength and forced-change settings WikiIoT methodology