Phison PS3111-S11 CVE-2026-84696

Requires the ability to send raw ATA vendor unique commands to the target Phison PS3111-S11 drive, which means privileged local host access (administrator/root) or direct physical access to the SATA interface - consistent with CVSS AV:L and PR:H. The affected component must run PS3111-S11 firmware at or below SBFQT1.3. Exploitation is trivial on builds shipped with no VUC lock; on builds that implement the unlock handshake it is still feasible because the CRC-16 challenge is non-cryptographic and can be forged. Limiting factors: not remotely or network exploitable, no path via a normal SATA data channel without privileged command issuance, and the attacker must already possess the privileged foothold before this flaw yields firmware/flash access.

The CVSS 4.0 score of 9.3 is driven by catastrophic technical impact (VC:H/VI:H/VA:H plus subsequent-system SC:H/SI:H/SA:H reflecting host compromise) combined with low attack complexity, but the vector is explicitly local (AV:L) and requires high privileges (PR:H) - this is not a remote or network-exploitable flaw, which materially lowers real-world urgency relative to the headline number. An attacker must already be able to issue raw ATA VUCs to the target drive, which in practice means administrator/root on the host or physical/interface access; this is a post-compromise persistence and firmware-implant primitive rather than an initial access vector. No CISA KEV listing and no EPSS score were provided, so there is no signal of active or probabilistically-likely exploitation; the primary elevated signal is that public tooling and a detailed writeup lower the effort to weaponize. The 'Authentication Bypass' tag is reasonable given the defeatable CRC-16 lock, though the assigned CWE-306 (missing authentication) is the more precise root cause; both descriptions are consistent. Given persistence below the OS and the ubiquity of this controller in budget SSDs, even a mid-sized municipal IT team in tczew should treat a confirmed implant as a full drive-replacement event - but this ranks below internet-facing critical CVEs for patch prioritization because exploitation presupposes existing privileged access.

An attacker who has gained administrator/root on a workstation or server containing a PS3111-S11-based SSD uses the publicly available 'disksec'/'psychite' tooling to issue vendor unique commands over ATA, defeats the CRC-16 unlock (or targets a build with no VUC lock), and writes a malicious payload into controller firmware and raw flash. The implant persists across reboots, power cycles, and OS reinstallation, allowing covert data exfiltration or tampering below the operating system's visibility. Given AV:L/AC:L, exploitation is straightforward once the privileged local foothold exists, and working PoC code lowers the barrier substantially.