Synology RackStation (RS820+)

{{Classification |name=Synology RackStation RS820+ |brand=Synology |website=https://www.synology.com/en-global/support/download/RS820%2B |release_date=2019-09-17 |generation=plus series |model=RS820+ |type=NAS |status=End of sale |dimensions=44 × 430.5 × 503 mm (H × W × D) |mass=6.9 kg |operating_system=Synology DSM; assessment: DSM 7.2.2-72806 Update 10 |companion_app=DS finder (Android/iOS); DSM web interface |cpu=Intel Atom C3538; 4 cores; 2.1 GHz |memory=2 GB DDR4 ECC RDIMM; expandable to 18 GB |storage=8 × 2.5/3.5-inch SATA HDD/SSD bays; drives sold separately |power=8 × 2.5/3.5-inch SATA HDD/SSD bays; drives sold separately |display=Status LEDs |sound=System notification buzzer |connectivity=4 × 1GbE RJ-45; 2 × USB 3.0; optional 10GbE upgrade module |device_known_hardware_tampering=Rare |device_known_hardware_tampering_proof=[[1](https://kb.synology.com/en-global/DSM/tutorial/How_to_reset_my_Synology_NAS_7)] [[2](https://global.download.synology.com/download/Document/Hardware/DataSheet/RackStation/19-year/RS820%2B/enu/Synology_RS820%2B_Data_Sheet_enu.pdf)] |device_known_hardware_tampering_comment=As a 1U rack-mounted model typically deployed in controlled server rooms, physical tampering requires data center access; risks remain limited to personnel with physical proximity to the rack. |device_known_vulnerabilties=Rare |device_known_vulnerabilties_proof=[[3](https://www.synology.com/en-global/security/advisory/Synology_SA_24_20)] |device_known_vulnerabilties_comment=Multiple DSM security flaws have been disclosed and patched during this rackmount model's lifecycle; the evaluated firmware version addresses all issues in the referenced advisory. |device_prior_attacks=Rare |device_prior_attacks_proof=[[4](https://www.synology.com/en-global/company/news/article/BruteForce)] |device_prior_attacks_comment=The 2021 StealthWorker campaign primarily targeted consumer-facing desktop NAS devices; this rack-mounted business model is not named as a confirmed victim in public documentation. |device_updatability=Very common |device_updatability_proof=[[5](https://www.synology.com/en-global/releaseNote/DSM?model=RS820%2B)] [[6](https://www.synology.com/en-global/products/status)] |device_updatability_comment=As a business-oriented rackmount plus model, it maintains long-term DSM support with regular security and maintenance updates through 2026. |system_authentication_with_other_systems=Partial |system_authentication_with_other_systems_proof=[[7](https://kb.synology.com/en-us/DSM/help/DSM/AdminCenter/file_share_privilege_nfs?version=7)] |system_authentication_with_other_systems_comment=The assessed NFS deployment relies on AUTH_SYS client UID/GID validation; Kerberos mutual cryptographic authentication is not configured in this setup. |system_communications=No encryption |system_communications_comment=Unencrypted HTTP administration is active across all four network interfaces in the test profile; optional HTTPS does not negate the presence of this plaintext access path. |system_storage=No encryption |system_storage_proof=[[8](https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/file_share_create?version=7)] [[9](https://global.download.synology.com/download/Document/Hardware/DataSheet/RackStation/19-year/RS820%2B/enu/Synology_RS820%2B_Data_Sheet_enu.pdf)] |system_storage_comment=User data across the 8-bay SATA drive array is unencrypted in this evaluation; enterprise-grade shared folder encryption is available but not enabled for this assessment. |user_authentication_account_management=Full |user_authentication_account_management_proof=[[10](https://www.synology.com/en-global/dsm/7.2/software_spec/dsm)] |user_authentication_account_management_comment=DSM provides comprehensive identity and access management for business deployments, including granular permissions, group policies and full account lifecycle operations. |user_authentication_authentication=Basic |user_authentication_authentication_proof=[[11](https://kb.synology.com/en-global/DSM/tutorial/How_to_reset_my_Synology_NAS_7)] [[12](https://global.download.synology.com/download/Document/Software/UserGuide/Os/DSM/7.2/enu/Syno_UsersGuide_NAServer_7_2_enu.pdf)] |user_authentication_authentication_comment=This assessment covers password-based local login only; without multi-factor authentication and with physical reset capability, the authentication strength rating is Basic. |user_authentication_brute_force_protection=Exist |user_authentication_brute_force_protection_proof=[[13](https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/connection_security_protection?version=7)] [[14](https://global.download.synology.com/download/Document/Hardware/DataSheet/RackStation/19-year/RS820%2B/enu/Synology_RS820%2B_Data_Sheet_enu.pdf)] |user_authentication_brute_force_protection_comment=Auto Block is configured to block source IPs after 5 failed authentication attempts within a 5-minute window across all network ports. |user_authentication_event_logging=Access event logged |user_authentication_event_logging_proof=[[15](https://kb.synology.com/en-global/DSM/help/DSM/MainMenu/security?version=7)] |user_authentication_event_logging_comment=All administrative login events are logged with timestamp, access method and source IP, supporting basic compliance and audit requirements. |user_authentication_passwords=Default/Common/Easy to guess |user_authentication_passwords_proof=[[16](https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/file_user_advanced?version=7)] |user_authentication_passwords_comment=The enforced policy mandates 12-character complex passwords and forces password rotation for all temporary credentials assigned by administrators. }} Documentation-based security evaluation for Synology RackStation RS820+, completed on 2026-10-24.

This 8-bay 1U rackmount plus-series NAS, designed for small business and remote office server room deployments with redundant power, is assessed against a specific DSM 7.2.2-72806 Update 10 configuration. The deployment uses local user accounts with password-only web administration, enables HTTP management access and an NFS AUTH_SYS file share on the office LAN. Supported internal SATA SSDs host an unencrypted shared data volume for centralized team storage. Auto Block brute-force protection is activated at 5 failed attempts within 5 minutes. Password policies enforce a 12-character minimum with mixed character sets, and all temporary admin passwords must be changed on initial login. Standard physical reset functionality remains enabled. All ratings apply solely to this documented configuration, and do not represent factory defaults or hands-on hardware testing.

Security ratings are mapped directly from published DSM specifications and the explicitly defined deployment profile. The "Rare" classification denotes a qualitative judgment of limited, well-defined exposure, not an empirically measured occurrence rate. Historical attack entries refer to platform-wide DSM incidents and do not confirm this rackmount model was specifically targeted; most documented campaigns focus on consumer desktop deployments. The active HTTP plaintext management interface across all four network ports is the basis for the "No encryption" communications rating. Storage ratings reflect only user data volume encryption status and do not assume encryption for system boot components. Optional security features are not treated as active unless explicitly included in the assessment scope. Historical CVE records do not imply vulnerability in the fully patched firmware build under review.

Release date reference: 2019-09-17, as stated in the official global English / Taipei launch announcement; this date is not claimed to be the earliest point of worldwide retail sale.

Historical vulnerabilities: CVE-2024-10441 (remote code execution), CVE-2024-50629 (limited file disclosure), CVE-2024-10445 (update certificate validation flaw). These affect DSM 7.2.2 prior to 7.2.2-72806 Update 1; Update 10 used in this assessment includes all corresponding patches.

No physical device was tested during this evaluation. All ratings must be interpreted within the stated configuration and supporting evidence scope.

RS820+ official launch announcement RS820+ official datasheet Synology product sales and support status RS820+ DSM release history DSM 7.2 official user guide (PDF) Synology physical reset and its security effects Synology-SA-24:20 — DSM vulnerabilities and fixes Synology PSIRT — StealthWorker attacks, 2021-08-04 DSM NFS permissions — AUTH_SYS and Kerberos DSM shared-folder creation — optional encryption DSM 7.2 technical specifications — accounts and services DSM Auto Block — failed-login limits DSM personal security — login history DSM password strength and forced-change settings WikiIoT methodology