Phison PS3111-S11 CVE-2026-82876

Exploitation requires the ability to issue firmware-update commands to the PS3111-S11 controller, which per CVSS PR:H and AV:L means local high-privilege access - host administrator/root or physical/debug (JTAG) access to the drive - not remote or network exploitation. The specific enabling weakness is that the controller reads the RSA public modulus from the firmware image's own signature segment rather than from immutable storage, so any attacker-supplied key pair with a self-consistent modulus/signature passes verification. Limiting factors: the attacker must already hold privileged local access to flash firmware, no default network-facing path exists, and exploitation is per-device rather than scalable across a fleet remotely; user interaction is not required once flash access is obtained.

This is a high-severity but access-gated issue. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N) indicates local access with high privileges is required - an attacker must already be able to issue vendor/firmware-update commands to the drive, typically implying local administrator/root on the host or physical/JTAG access, not remote unauthenticated exploitation. Weighed against that, the impact metrics are maximal (VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H), reflecting that malicious firmware sits below the operating system and can persist across OS reinstalls, exfiltrate or tamper with all data passing through the controller, and brick the device. A public POC exists, which raises practical risk, but there is no KEV listing and no EPSS score provided, and the high-privilege prerequisite means this is more a targeted/supply-chain and evil-maid concern than a mass-exploitation one. The realistic threat model is firmware implants, evil-maid attacks, and supply-chain tampering rather than opportunistic remote compromise; organizations handling sensitive data on affected drives should nonetheless treat firmware-level persistence as urgent given how hard it is to detect and remediate.

An attacker with local admin on the host, or brief physical access to the machine (evil-maid), generates an RSA key pair, signs a malicious firmware image, embeds the matching modulus in the signature segment, and flashes it to the PS3111-S11 controller, which accepts it as valid. The implanted firmware persists beneath the OS across reinstalls and can silently exfiltrate or modify stored data. A public POC (the 'psychite' toolkit) demonstrates the signature-bypass, lowering the bar to weaponize this.