CVE-2026-82876 Overview
CVE-2026-82876 is a firmware signature verification flaw affecting the Phison PS3111-S11 SATA SSD controller. The controller validates RSA signatures against a public modulus embedded within the firmware image itself, rather than anchoring the trust root in immutable storage. Attackers with local access can generate an arbitrary RSA key pair, sign modified firmware with the private key, embed the matching modulus in the signature segment, and load the tampered firmware. The controller accepts the malicious image as legitimate. This vulnerability maps to CWE-347: Improper Verification of Cryptographic Signature and enables persistent, below-OS compromise of affected storage devices.
Critical Impact
Attackers can install arbitrary firmware on Phison PS3111-S11 SSDs, achieving persistent code execution that survives OS reinstallation and can compromise data integrity, confidentiality, and system availability.
Affected Products
- Phison PS3111-S11 SATA SSD controller firmware
- Consumer and OEM SSDs shipping with the PS3111-S11 controller
- Storage devices relying on the embedded-modulus signature scheme documented in the Phison S11 firmware analysis
Discovery Timeline
- 2026-08-31 - CVE-2026-82876 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-82876
Vulnerability Analysis
The Phison PS3111-S11 controller implements firmware authenticity checks using RSA signature verification. Instead of comparing against a public key or key hash fused into read-only controller memory, the verification routine reads the RSA modulus from the firmware image being validated. This design defeats the fundamental purpose of code signing, because the entity supplying the signed image also supplies the key used to verify it.
An attacker who can craft a firmware image can generate a fresh RSA key pair, embed the public modulus into the signature segment of the image, and produce a signature over the modified payload using their private key. When the controller loads the image, it extracts the attacker-supplied modulus, verifies the attacker-supplied signature, and passes verification. Successful exploitation grants code execution on the SSD controller, which sits below the operating system and outside endpoint visibility.
Root Cause
The root cause is a missing hardware root of trust for firmware verification. RSA signature validation is cryptographically sound only when the verifier's public key is anchored in a location the adversary cannot rewrite. In the PS3111-S11 design, the public modulus travels with the firmware image, so the trust anchor and the signed artifact are supplied by the same untrusted source.
Attack Vector
Exploitation requires local access with sufficient privilege to issue vendor-specific firmware update commands to the drive over the SATA interface. An attacker with administrative privileges on the host, physical possession of the drive, or a supply chain foothold can push a tampered image. Once installed, the malicious firmware persists across host operating system reinstalls and disk wipes. See the VulnCheck advisory on Phison PS3111, the Phison S11 firmware analysis, and the Psychite research repository for technical detail. No public exploit binary is listed at this time.
Detection Methods for CVE-2026-82876
Indicators of Compromise
- Unexpected firmware version strings reported by SMART or vendor tooling on PS3111-S11 SSDs
- Firmware update commands (ATA DOWNLOAD MICROCODE, opcode 0x92) issued outside sanctioned maintenance windows
- Drives exhibiting altered read/write behavior, hidden sectors, or unexplained LBA remapping after routine host activity
Detection Strategies
- Baseline firmware revisions across the fleet and alert on drift for PS3111-S11 controllers
- Log and correlate host-side privileged storage operations, including vendor utilities that invoke firmware download opcodes
- Inspect SATA command telemetry for DOWNLOAD MICROCODE traffic from non-administrative processes
Monitoring Recommendations
- Track process execution of vendor firmware update binaries and flag unsigned or unexpected variants
- Monitor for privilege escalation chains that precede storage firmware access
- Alert on drives that report firmware versions absent from the approved vendor manifest
How to Mitigate CVE-2026-82876
Immediate Actions Required
- Inventory all endpoints and servers containing SSDs built on the Phison PS3111-S11 controller
- Restrict administrative access on hosts with affected drives, since exploitation requires local high-privilege access
- Block or audit execution of firmware update utilities through application control policies
- Treat any suspected compromise of a PS3111-S11 drive as unrecoverable through software means and plan hardware replacement
Patch Information
No vendor patch is listed in the NVD entry for CVE-2026-82876 at the time of publication. The flaw is a design issue in how the controller anchors its verification key, which cannot be fully remediated without a firmware architecture change that binds trust to immutable storage. Consult Phison and the affected SSD OEM for updated firmware or hardware revisions.
Workarounds
- Enforce full-disk encryption with keys stored outside the affected drive so tampered firmware cannot silently exfiltrate cleartext data
- Disable or restrict SATA DOWNLOAD MICROCODE capability at the host or chipset level where supported
- Physically secure systems containing affected drives to reduce offline tampering risk
- Replace affected drives in high-assurance environments with SSDs whose controllers anchor signature verification in immutable ROM or OTP fuses
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.