PS3111-S11 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/ps3111-s11/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 31 Aug 2026 12:00:38 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgImproper RSA Signature Validation in Phison PS3111-S11 Controller Firmwarehttps://feed.craftedsignal.io/briefs/2026-08-phison-firmware-vulnerability/Mon, 31 Aug 2026 12:00:38 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-phison-firmware-vulnerability/The Phison PS3111-S11 controller firmware is vulnerable to arbitrary firmware modification due to RSA signature validation against an embedded public modulus rather than immutable hardware-backed storage.The Phison PS3111-S11 controller firmware contains a critical architectural flaw (CVE-2026-82876) where RSA signature verification for firmware updates relies on a public modulus embedded directly within the mutable firmware image. Because this modulus is not anchored in immutable storage, such as a hardware-based root of trust, the verification process is entirely dependent on data that can be modified by an attacker. This flaw allows unauthorized parties to perform a man-in-the-middle or direct-access attack to replace legitimate firmware with malicious versions. By generating a custom RSA key pair and embedding the attacker-controlled public modulus into the signature segment of a tampered firmware image, the controller incorrectly identifies the malicious code as signed and legitimate. This vulnerability enables persistent, deep-level compromise of the storage device controller, potentially leading to unauthorized data access, persistence, and complete bypass of hardware-level security controls.

Impact

Successful exploitation allows for the installation of malicious, persistent firmware on the Phison PS3111-S11 controller. This provides an attacker with the ability to execute code at the controller level, potentially bypassing OS-level protections and maintaining long-term presence on the storage device that survives operating system reinstallation or disk formatting.

Recommendation

Prioritize inventory of devices utilizing the Phison PS3111-S11 controller to assess the exposure surface. Coordinate with hardware vendors to determine if firmware update mechanisms or patches are available to mitigate the reliance on mutable signature verification. As this vulnerability occurs at the controller level, traditional OS-level security logs may not be sufficient for detection; consider firmware integrity monitoring if supported by the management infrastructure.

]]>highadvisoryhardware-securityfirmware-vulnerabilitypersistence