A critical vulnerability exists in the Phison PS3111-S11 storage controller firmware where RSA signature verification is fundamentally broken. The firmware validates signatures using a public modulus embedded within the firmware image itself rather than storing it in immutable, trusted hardware storage. This design flaw allows attackers to generate their own RSA key pairs, sign malicious firmware with the private key, and embed the corresponding public modulus into the firmware image. The controller then accepts this attacker-crafted firmware as legitimate, completely bypassing firmware integrity protections. This vulnerability enables persistent, low-level compromise of storage devices using the affected controller, potentially surviving OS reinstalls and standard security measures. The attack could be used to deploy firmware-level implants or destructive payloads on affected drives. Public proof-of-concept tooling and detailed writeups are available, significantly lowering the barrier to exploitation.
