CRITICAL 9.3 NVD
CVE-2026-84696
Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent or defeatable authen
Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent or defeatable authentication mechanisms. Attackers can bypass the weak CRC-16 based unlock handshake or exploit builds with no VUC lock to read and write controller memory and raw flash, persisting implants across power cycles.
References
- https://github.com/trulycrisp/disksec
- https://github.com/trulycrisp/psychite
- https://trulycrisp.github.io/drivefirmware/phison_s11/
- https://www.vulncheck.com/advisories/phison-ps3111-s11-controller-firmware-missing-authent
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-09-02 via NVD.
Risk Timeline
CVE Disclosed2026-09-02 · -1 days ago
Remediation Resources
vulnfeed aggregates 11552 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.