Privilege Escalation in Phison PS3111-S11 Controller Firmware
CVE-2026-84696

9.3CRITICAL

Key Information:

Vendor: Phison Electronics Corporation
Status: Ps3111-s11 Controller Firmware
Vendor: CVE Published:; 2 September 2026

🔔 Create Phison Electronics Corporation Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-84696?

The Phison PS3111-S11 controller firmware versions up to SBFQT1.3 expose a significant vulnerability that allows unauthorized access to privileged vendor unique commands via the ATA interface. This weakness arises from absent or easily defeatable authentication mechanisms, enabling attackers to circumvent a weak CRC-16 based unlock handshake. In vulnerable builds that do not enforce a VUC lock, it becomes possible for attackers to manipulate the controller memory and raw flash, effectively persisting implants through power cycles.

Affected Version(s)

PS3111-S11 Controller Firmware SBFQT1.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-84696 - Proof of Concept