CVE-2026-84696
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent or defeatable authentication mechanisms. Attackers can bypass the weak CRC-16 based unlock handshake or exploit builds with no VUC lock to read and write controller memory and raw flash, persisting implants across power cycles.
Risk Assessment
The risk includes the possibility of permanently installing malware in the disk controller memory, which can lead to data integrity compromise and persistent system compromise.
Recommendation
It is recommended to update the controller firmware to a version newer than SBFQT1.3 if available, and to restrict physical access to the drives.
Other vulnerabilities in Phison PS3111-S11
Original NVD description (English source)
Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent or defeatable authentication mechanisms. Attackers can bypass the weak CRC-16 based unlock handshake or exploit builds with no VUC lock to read and write controller memory and raw flash, persisting implants across power cycles.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS