CVE-2026-82876: Improper Verification of Cryptographic Signature in Phison Electronics Corporation PS3111-S11 Controller Firmware

The Phison PS3111-S11 controller firmware improperly verifies cryptographic signatures by relying on a public modulus embedded within the firmware image itself instead of anchoring it in immutable storage. This design flaw enables attackers to create arbitrary RSA key pairs, sign maliciously modified firmware with the corresponding private key, and embed the matching modulus in the signature segment. Consequently, the controller accepts the tampered firmware as authentic and valid, compromising firmware integrity. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity. The product is a cloud service, and a patch is available, though specific patch details are not provided.

An attacker with high privileges can bypass firmware signature verification, allowing installation of malicious firmware on the PS3111-S11 controller. This compromises the integrity and trustworthiness of the firmware, potentially leading to persistent device compromise. The vulnerability affects the cryptographic trust model of the controller firmware, enabling unauthorized firmware modifications to be accepted as valid.

A patch is available for this vulnerability. Since the affected product is a cloud service, the vendor manages remediation server-side. Users should consult the vendor advisory for confirmation and ensure their firmware is updated to the patched version as provided by Phison Electronics Corporation.