EUVD-2026-69787
GHSA-p44m-vhp2-rrrf
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local ATA access and privileged host/interface control give AV:L/PR:H; no-lock or forgeable CRC-16 handshake keeps AC:L; a firmware implant subverts the host beyond the drive, so S:C with full C/I/A impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent or defeatable authentication mechanisms. Attackers can bypass the weak CRC-16 based unlock handshake or exploit builds with no VUC lock to read and write controller memory and raw flash, persisting implants across power cycles.
AnalysisAI
Firmware-level compromise of the Phison PS3111-S11 SATA SSD controller allows an attacker with privileged local host access to read and write controller SRAM and raw NAND flash by abusing privileged vendor unique commands (VUCs) exposed over the ATA interface. Firmware builds through SBFQT1.3 either ship with no VUC lock or use a weak CRC-16 unlock handshake that can be trivially defeated, enabling a persistent firmware implant that survives power cycles and OS reinstalls. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the ability to send raw ATA vendor unique commands to the target Phison PS3111-S11 drive, which means privileged local host access (administrator/root) or direct physical access to the SATA interface - consistent with CVSS AV:L and PR:H. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 9.3 is driven by catastrophic technical impact (VC:H/VI:H/VA:H plus subsequent-system SC:H/SI:H/SA:H reflecting host compromise) combined with low attack complexity, but the vector is explicitly local (AV:L) and requires high privileges (PR:H) - this is not a remote or network-exploitable flaw, which materially lowers real-world urgency relative to the headline number. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released fixed firmware version was identified in the available data (the referenced material describes the weakness and tooling but does not cite a patched build beyond noting the flaw persists through SBFQT1.3), so treat this as: no vendor-released patch identified at time of analysis - monitor Phison and the downstream SSD vendor for a firmware update that enforces authenticated VUC access. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all infrastructure for Phison PS3111-S11 SSDs across servers, storage arrays, and endpoints using hardware inventory tools and BIOS reporting. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today