CVE-2026-82876

Phison PS3111-S11 SSD controller firmware validates RSA firmware signatures against a public modulus embedded in the firmware image itself, rather than one anchored in immutable storage such as ROM or one-time-programmable memory, so the root of trust is not fixed. An attacker with the ability to write firmware to the drive can generate their own RSA key pair, sign modified firmware with the private key, and embed the matching modulus in the signature segment; the controller then accepts the tampered firmware as authentic. This completely defeats firmware authentication, allowing persistent, stealthy malicious firmware with high impact on the confidentiality, integrity, and availability of data on the drive (CVSS 4.0 rates it 9.3 Critical, with local attack vector and high privileges required). Any system using an SSD built on a PS3111-S11 controller is affected; these controllers shipped in high volumes inside consumer and OEM SATA drives sold under many brands. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation exists; EPSS currently estimates a 0.1% probability of exploitation within 30 days.

What to do: Identify whether your SSDs use a PS3111-S11 controller (e.g., via CrystalDiskInfo or the drive vendor's utility) and apply firmware updates from the SSD vendor or Phison when released, since remediation requires reflashing the controller rather than a host-side patch. Until then, only run firmware-update utilities and firmware images obtained from trusted vendor sources, and treat local administrator compromise as sufficient for an attacker to install tampered drive firmware. No workaround is available because the flawed key-verification design resides in the controller firmware itself.