Description

Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent or defeatable authentication mechanisms. Attackers can bypass the weak CRC-16 based unlock handshake or exploit builds with no VUC lock to read and write controller memory and raw flash, persisting implants across power cycles.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-02T01:17:24.560Z",
  "pubdate": "2026-09-02T01:17:24.560Z",
  "executiveSummary": "The Phison PS3111-S11 controller firmware is vulnerable to improper access control regarding vendor-unique commands (VUCs) exposed via the ATA interface. This vulnerability impacts all firmware versions up to and including SBFQT1.3. The security flaw stems from either the complete absence of a locking mechanism for privileged commands or the implementation of an easily bypassable CRC-16 based authentication handshake.\nThis vulnerability allows an attacker with low-privileged access to the underlying operating system to gain direct interaction with the storage controller’s firmware. By bypassing the weak authentication, an attacker can execute arbitrary read and write operations on the controller’s memory and raw NAND flash storage. The implications are critical, as this grants an adversary the ability to manipulate low-level hardware states, circumvent filesystem-level security, and install persistent, firmware-level implants that survive device power cycles and OS reinstallation. The exploit does not require physical access if the attacker has the ability to issue raw ATA commands from the host OS, making it a significant vector for rootkits and hardware-level persistence.",
  "technicalDetails": "The vulnerability resides within the Phison PS3111-S11 firmware command processing logic. The controller exposes Vendor Unique Commands (VUCs) that provide diagnostic, debugging, and advanced hardware management capabilities. These commands are processed directly by the controller's processor, bypassing the standard operating system I/O stack and security controls.\nRoot cause: The fundamental security flaw is a failure to properly implement authentication for privileged diagnostic commands. In many instances, the firmware lacks any lock mechanism for these VUCs. Where protection exists, it relies on a weak CRC-16 based handshake protocol. Because the CRC-16 algorithm is computationally inexpensive and predictable, an attacker can brute-force the handshake sequence or derive the expected response to successfully authenticate without knowing a secret key.\nExploitation flow: An attacker initiates the exploit by constructing specially crafted ATA commands directed at the device's control registers. Step 1: The attacker determines if the target firmware version is SBFQT1.3 or earlier. Step 2: The attacker sends an initial handshake request to the device. Step 3: If the device implements the CRC-16 mechanism, the attacker intercepts or predicts the required challenge response. Step 4: Once the 'unlocked' state is achieved, the attacker issues privileged VUCs to map arbitrary memory locations within the controller or to directly address the NAND flash memory blocks.\nPost-exploitation impact: Successful exploitation allows for complete controller compromise. Attackers can perform arbitrary firmware patching, enabling the installation of malicious payloads into the controller’s flash memory. Because the controller manages the hardware abstraction layer, the implant can intercept, modify, or exfiltrate data being written to or read from the disk without the host operating system being aware of the tampering. Since the malicious code resides on the controller, it remains persistent across power cycles and is entirely invisible to traditional endpoint detection and response (EDR) agents or antivirus software running on the host OS. The lack of cryptographic signing or verification of the firmware update/modification process allows for the permanence of these implants."
}