VulnSocial

CVE-2026-82876Disclosure

LOWCVSS 9.3 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Phison PS3111-S11 controller firmware verifies RSA signatures using a public modulus embedded within the firmware image itself rather than anchored in immutable storage. Attackers can generate arbitrary RSA key pairs, sign modified firmware with the private key, embed the matching modulus in the signature segment, and the controller accepts the tampered firmware as valid.

Back to dashboard
1.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-347

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-08-31); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-08-31: 1Mentions · 2026-09-04: 1PoC Mentioned / Linked · 2026-09-04: 1Technical Details · 2026-08-31: 1Technical Details · 2026-09-04: 108-3109-04
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • Hunt-Benito@HB_CyberSec
    Disclosure

    CVE-2026-82876 (9.3 Critical): Phison S11 SSD firmware is RSA-signed — against a modulus embedded in the firmware file itself. In 100M+ Kingston A400s. Bring your own key, sign your implant: accepted. No fix exists. #Infosec #Firmware https://hunt-benito.com/blog/the-key-ships-with-the-lock-cve-2026-82876-phison-s11-ssd-firmware-signature-bypass/ https://t.co/Z12c6rQOPk

    Post summary

    The tweet announces the CVE‑2026‑82876 vulnerability in Phison S11 SSD firmware, highlights that it allows attackers to sign implants using embedded RSA keys, mentions no fix exists, and links to a blog likely containing PoC details.

    0000044
    5 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-82876 Phison PS3111-S11 controller firmware verifies RSA signatures using a public modulus embedded within the firmware image itself rather than anchored in immutable stora… https://www.cve.org/CVERecord?id=CVE-2026-82876

    Post summary

    The CVE discloses that Phison PS3111-S11 controller firmware verifies RSA signatures using an embedded public key, a design flaw that could allow signature forgery.

    000001.9K
    58.0K followersView on X

Explore more

Back to dashboard