CVE-2026-82876: Phison PS3111-S11 Controller Firmware Signature Verification Bypass
Phison PS3111-S11 controller firmware verifies RSA signatures using a public modulus embedded within the firmware image itself rather than anchored in immutable storage. Attackers can generate arbitrary RSA key pairs, sign modified firmware with the private key, embed the matching modulus in the signature segment, and the controller accepts the tampered firmware as valid.
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The published vector indicates local access with high privileges is required. Exploitation involves supplying a modified controller firmware image that contains an attacker-controlled RSA modulus and a matching signature.
What is the practical impact if exploitation succeeds?
A successful attacker can cause the controller to accept arbitrary modified firmware as valid. The listed impacts include high confidentiality, integrity, and availability impact, with scope changed.
How can defenders determine whether a device is affected?
The issue applies to devices using the Phison PS3111-S11 controller firmware. Confirm the controller model and assess whether its firmware verification uses a public RSA modulus sourced from the firmware image rather than immutable storage.