CVE-2026-84696: Phison PS3111-S11 Privilege Escalation Flaw

CVE-2026-84696 Overview

CVE-2026-84696 affects Phison PS3111-S11 solid-state drive (SSD) controller firmware through version SBFQT1.3. The firmware exposes privileged vendor unique commands (VUCs) over the ATA interface with absent or defeatable authentication. Attackers who can issue ATA commands to an affected drive can bypass a weak CRC-16 based unlock handshake, or exploit firmware builds shipped without any VUC lock, to read and write controller memory and raw NAND flash. Successful exploitation allows persistent implants that survive power cycles and operating system reinstallation. The weakness is tracked as CWE-306: Missing Authentication for Critical Function.

Critical Impact
Attackers with local drive access can persist firmware-level implants below the operating system, bypassing endpoint security and surviving reimaging.

Affected Products

Phison PS3111-S11 SSD controller firmware versions through SBFQT1.3
Consumer and OEM SATA SSDs built on the PS3111-S11 controller platform
Firmware builds shipped without any vendor unique command lock

Discovery Timeline

2026-09-02 - CVE-2026-84696 published to the National Vulnerability Database
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84696

Vulnerability Analysis

The Phison PS3111-S11 controller exposes vendor unique commands through the ATA command set for manufacturing, diagnostics, and firmware update operations. These VUCs permit direct reads and writes to controller SRAM, memory-mapped registers, and raw NAND flash regions holding firmware code and metadata.

Some firmware builds ship with no lock on the VUC interface, allowing any host with SATA access to issue privileged commands. Other builds implement an unlock handshake based on a CRC-16 checksum, which does not provide cryptographic authentication and can be recomputed by an attacker. Once unlocked, an attacker can modify firmware regions to install persistent implants that execute on every drive power-up. The compromise sits below the operating system, so reinstalling the OS or wiping user data does not remove it.

Root Cause

The root cause is missing authentication on a critical function [CWE-306]. Privileged controller operations rely either on the absence of any access control or on a non-cryptographic CRC-16 handshake. CRC-16 is an integrity checksum, not a keyed authenticator, so it cannot resist an attacker who observes or reproduces the algorithm.

Attack Vector

Exploitation requires local access to issue ATA commands to the target drive, either from the host operating system with high privileges or through a physically attached interface. An attacker sends the vendor unique unlock sequence, computes the expected CRC-16 response, and then issues follow-on VUCs to read or write controller memory and flash. Public research and tooling documenting the interface are available in the Drive Firmware Analysis writeup for Phison S11, the disksec repository, the psychite project, and the VulnCheck advisory.

Detection Methods for CVE-2026-84696

Indicators of Compromise

Unexpected ATA PASS-THROUGH (opcode 0xA1/0x85) traffic to SSDs from non-administrative processes.
Presence of drive utilities such as hdparm, sg_raw, or the referenced disksec and psychite tools on endpoints without a maintenance justification.
SSDs reporting firmware version strings or SMART attributes that differ from the vendor-shipped baseline for the same model.

Detection Strategies

Baseline firmware revisions across the fleet and alert when drives report a firmware string not on the approved list.
Monitor process execution and command-line telemetry for use of raw SCSI/ATA pass-through utilities by non-IT users.
Correlate physical access events, boot anomalies, and unexplained I/O errors that can indicate flash rewrites in progress.

Monitoring Recommendations

Ingest endpoint process, driver load, and USB or SATA device events into a central data lake for retrospective hunts.
Track administrative sessions that interact with block devices outside of scheduled maintenance windows.
Alert on repeated ATA command errors or vendor-specific opcodes recorded by storage stack logging.

How to Mitigate CVE-2026-84696

Immediate Actions Required

Inventory endpoints and servers that ship with Phison PS3111-S11 based SSDs and identify firmware revisions in use.
Restrict local administrator rights so unprivileged users cannot issue ATA pass-through commands.
Enforce full-disk encryption so raw flash contents remain protected even if controller memory is read.

Patch Information

No vendor patch is referenced in the NVD entry at publication. Organizations should monitor Phison and the affected SSD OEMs for updated firmware that removes unauthenticated VUCs or replaces the CRC-16 handshake with a cryptographic authentication scheme. Consult the VulnCheck advisory for advisory updates.

Workarounds

Physically retire or replace affected drives in high-assurance environments where firmware persistence is unacceptable.
Block installation and execution of raw ATA/SCSI pass-through utilities on production endpoints via application control policies.
Require secure boot and measured boot to reduce the value of firmware-level persistence for downstream OS attacks.

bash

# Configuration example: identify Phison PS3111-S11 drives and firmware revisions on Linux
for dev in /dev/sd?; do
  model=$(sudo smartctl -i "$dev" | awk -F: '/Device Model/{print $2}' | xargs)
  fw=$(sudo smartctl -i "$dev" | awk -F: '/Firmware Version/{print $2}' | xargs)
  echo "$dev | model=$model | firmware=$fw"
done