UGREEN NAS vs Synology: Who Publishes the Bugs?

Every UGREEN-versus-Synology comparison I can find compares the same five things: bay count, CPU, RAM ceiling, transcoding, and price. Those are the specs on the box. None of them answer the question that actually decides whether you still trust the machine in year three, which is whether the vendor tells you when it is broken.

So I ran that comparison instead. I scraped Synology's entire published security advisory index, pulled every UGREEN CVE in the US National Vulnerability Database, read UGREEN's own vulnerability disclosure policy, and then went looking for the archive that policy implies. This took about ninety minutes and nobody had assembled it, which is the only reason it is worth publishing.

I own neither NAS. The Mac mini that runs this business is not a NAS, and I have said in my Mac mini versus NAS comparison why I have not bought one. Nothing below is a hands-on review. Every product claim here is either a vendor document, a public vulnerability database record, or a community thread, and I label which one each time.

What I collected, and how much of it

Scope matters more than conclusions here, so here it is first. From synology.com/en-global/security/advisory I paged through the index until it returned an empty page, which happened at page 18. That yielded 338 unique advisories, running from Synology-SA-17:12 to Synology-SA-26:12, each with a title, severity, status and last-updated timestamp. The page is server-rendered, so the table is in the HTML.

For UGREEN I had no equivalent index to scrape, which turned out to be the finding. I fell back to the NVD REST API for both vendors, read the disclosure policy page, and checked the pages a security archive would plausibly live on. All figures below were read on 2026-08-18.

Synology publishes a lot, and it looks like this

338 advisories across nine and a half years. The yearly counts are not flat: 71 in 2017, 65 in 2018, then a long decline to 16 in 2023, then back up to 28 in 2024. Twelve so far in 2026.

Severity	Count
Moderate	142
Important	109
Critical	43
Not affected	31
Low	13

The status column is the part I did not expect. 310 are marked Resolved, 23 are Accepted, and five say “Will not fix”: SMBLoris, a SugarCRM issue, IKEv1, the Broadcom Wi-Fi driver flaw, and Kr00k. A vendor that publishes the ones it has decided not to fix is doing something harder than publishing the ones it fixed.

The individual advisories carry real detail. Synology-SA-26:11, a Critical MailPlus Server advisory from 2026-06-26, names CVE-2026-13136 with a CVSS3 base score of 10.0 and the full vector string, maps it to CWE-863, credits the ZDI submission IDs, and then gives the fixed package build per DSM version: upgrade to 4.0.1-31663 on DSM 7.3, 4.0.1-21663 on 7.2.2 and 7.2.1. That is enough for an owner to check their own box against it in about a minute.

The UGREEN side of the same question

UGREEN does have a written policy, and it is more specific than I expected. The UGREEN Vulnerability Disclosure Policy states that “All reported vulnerabilities are scored according to the Common Vulnerability Scoring System CVSS 3.1 criteria,” that “The report will be confirmed within 1 working day upon receipt,” and sets fix targets of 3 working days for critical, 7 for high risk, 30 for medium and 60 for low. It also says “A separate emergency security bulletin is issued for severe or significant impact vulnerabilities.”

I went looking for those bulletins. UGREEN's software enhancements and bug fixes page is a general release-notes page dated June 2024, listing a volume mount fix, Photos app bugs, thumbnail optimisation and LivePhoto viewing. No CVEs, no vulnerability entries. The obvious guesses at a security URL returned 404. The policy page itself carries no link to an archive and no last-updated date.

To be precise about what that establishes: I could not find a public archive. That is not the same as proving none exists.

The number that will mislead you

The NVD keyword search returns 317 results for Synology and 4 for UGREEN. Read casually, that says UGREEN is dramatically safer. It says nearly the opposite.

Synology is a standing target at Pwn2Own. At Pwn2Own Ireland 2025 in Cork, researchers earned over a million dollars across 73 zero-days; Synacktiv took $40,000 for root code execution on a Synology BeeStation Plus, and QNAP's TS-453E was compromised three separate ways. UGREEN appears nowhere in those results, because UGREEN is not on the target list. A low CVE count on a consumer NAS measures how few people are professionally attacking it, not how few bugs it has.

That said, the four UGREEN records are worth reading, and one of them is ugly. CVE-2025-14188 describes a remote command injection in handler_file_backup_create on the /v1/file/backup/create endpoint of the nas_svr component, affecting UGREEN DH2100+ up to firmware 5.3.0.251125. NVD scores it 7.2 High; the GitHub Advisory Database entry scores the same CVE 7.3 and carries a sentence NVD's text omits: “The vendor was contacted early about this disclosure but did not respond in any way.” A sibling buffer overflow in the same function is CVE-2025-14187.

Set that against the company's own published promise of confirmation within one working day. Those two are hard to hold at the same time.

Two accuracy notes I am not going to bury. Those CVEs name the DH2100+, which is UGREEN's budget ARM line with fixed RAM, not the Intel DXP models most buyers cross-shop against a DiskStation. And on CVE-2026-8185, UGREEN did respond, in a quote carried in the record itself: “We have successfully confirmed and reproduced the issue... The issue is scheduled to be resolved in the release version coming in late April.”

Where Synology's record gets worse

I did not want a table that only flattered one vendor, so I measured something Synology cannot spin: how long after a Pwn2Own event its advisories actually appear. I pulled the Publish Time field from all 14 advisories carrying a PWN2OWN label and subtracted the contest end date.

Event	Advisories	First published	Last published
Pwn2Own Toronto 2022	1	1 day before the contest ended	—
Pwn2Own Toronto 2023	2	+24 days	+25 days
Pwn2Own Ireland 2024	8	+1 day	+103 days
Pwn2Own Ireland 2025	3	+17 days	+53 days

The 2024 column is genuinely fast. SA-24:18 and SA-24:19 went up on 2024-10-25, the day after the contest closed, matching what SecurityWeek reported at the time: “Some of the vendors whose products were targeted during the competition went to work immediately after the researchers shared the details of their exploits.” Then 2025 slipped to 17 days for the first advisory and 53 for the last. On a four-event sample I would not call that a trend, but it is the wrong direction, and it is the number I would want tracked before my next purchase.

What owners actually say

Reddit has been returning 403 to every user agent I have tried for two days now, so this sample is Hacker News only, which biases it toward self-hosting people. Owners report a real performance gap in UGREEN's favour: one long-time Synology user who switched in December 2025 wrote that “Everything that synology offers is outdated and slow,” that a DXP6800 Pro “chewed through 98k photos” in about a day, and that face recognition tagged 15% more people than DSM had.

The counterweights come from the same neighbourhood. A commenter in that thread asked whether the UGREEN NAS OS does encryption at all; another raised the question of Chinese-vendor risk directly, drawing the reply that a NAS “should not be allowed to talk to the outside world” regardless of who made it. And one commenter's summary was that you are often better off with a UGREEN box running TrueNAS than with either stock OS.

How I would use this

If the box holds the only copy of something, the disclosure record is a real input and Synology wins it on volume, specificity and willingness to publish the bugs it declined to fix. If you are buying on performance per dollar and intend to check the SMB behaviour inside the return window anyway, the UGREEN hardware advantage is well documented by owners and the disclosure gap matters less, because the mitigation that thread kept repeating is the same either way: keep it off the open internet.

The one combination I would avoid is buying UGOS specifically for its security posture and never checking a forum, since on the evidence above the firmware changelogs are better documented by a German community wiki than by the vendor. Whichever way you go, the Time Machine over SMB requirements and the CMR versus SMR trap on the drives you put in it will cost you more grief than the brand choice will.

For reference, the two units in this comparison are the Synology DS425+ and the UGREEN NASync DXP2800, neither of which I own. Some links are affiliate links; commissions land on the public ledger.

Sources and limits: the 338-advisory dataset was scraped from Synology's public advisory index (pages 1–17) on 2026-08-18, and I read the full text of exactly one advisory plus the publish timestamps of the 14 PWN2OWN-labelled ones — the other 323 are counted from the index table only. CVE counts come from the NVD REST API keyword search, which is string matching and can miss records that spell a product differently. The Pwn2Own lag figures are my own subtraction against published contest dates, not a vendor-supplied metric. I own neither NAS and reproduced none of these vulnerabilities. I could not confirm UGREEN publishes no security bulletin archive, only that I failed to find one; if it exists, tell me and I will correct this. Synology's drive compatibility list is JavaScript-rendered and I could not read it, so it is absent here for the second time.