Repository navigation
Phison S11
The Phison S11 or PS3111 is a SATA SSD controller first introduced in 2016, with production continuing today. It was intended largely as a successor to the S9/PS3109 controller. This controller is common in budget SATA SSDs and can be found in drives sold under a wide variety of brand and model names.
The S11 controller has known security issues, including unrestricted access to sensitive Vendor Unique Commands (VUCs) and inadequate firmware signature verification. Two major vulnerabilities are assigned CVE-2026-82876 and CVE-2026-84696, and are further detailed here.
The controller used can sometimes vary even between drives with the same model designation, as vendors can change controllers throughout a drive model's production; as such, external branding or model designation alone cannot definitively identify a drive as having an S11 controller. Nonetheless, a non-exhaustive list of drive models known to use the Phison S11 is included below.
| Vendor | Model |
|---|---|
| Addlink | S22 |
| Apacer | AS340 |
| Apacer | AS450 |
| Corsair | Force LE200 |
| DEXP | M6 |
| Foxline | FLSSDX6SE |
| Gigabyte | GP-GSTFS31 |
| Goodram | CL100 |
| Goodram | CX300 |
| Goodram | CX400 |
| Goodram | IRDM |
| Goodram | S400U |
| Inland | Professional |
| KingMax | SMV |
| KingSpec | P3 |
| Kingston | A400 |
| Kingston | Q500 |
| Kioxia | Exceria SATA |
| Lite-On | MU3 |
| Lite-On | PH4 |
| Lite-On | PH6 |
| Maxtor | Z1 |
| MSI | S270 |
| OCZ | Trion 100 |
| Patriot | Burst |
| Patriot | Burst Elite |
| Patriot | Spark |
| Pioneer | APS-SL3 |
| PNY | CS2040 |
| PNY | CS900 |
| PNY | Elite |
| Seagate | BarraCuda Q1 |
| Seagate | One Touch SSD |
| Silicon Power | A56 |
| Silicon Power | A58 |
| Silicon Power | Bolt B75 Pro |
| Silicon Power | S55 |
| Silicon Power | S60 |
| Smartbuy | Revival 2 |
| Smartbuy | S11T |
| Team Group | CX2 |
| Team Group | GX1 |
| Team Group | L3 EVO |
| Team Group | Vulcan Z |
| Toshiba | TR200 |
| Transcend | SSD220S |
| Verbatim | Vi550 |
| Zotac | TD400 |
DiskSec performs the following checks for Phison S11 drives:
This check executes the VUC operation system info, which returns general information about the drive such as the firmware version and physical flash geometry.
If a drive is configured to restrict access to sensitive VUCs, this check attempts an authentication handshake to unlock access to those commands, using any of the five possible unlock keys a drive can have configured. This check must succeed for any of the following checks to be attempted.
This check attempts the VUC operation read info block, which reads a set of persistent configuration data from the drive, containing details such as the model name and serial number.
This check attempts the VUC operation verify flash to read the drive's firmware header, outputting the load address and size of each firmware section.
This check attempts the VUC operation read register to read directly from controller memory. It does this by reading from memory address 0x5C0E0000, a fixed address where an Xtensa exception vector table should always be located. It then parses the returned data, confirms it is a valid Xtensa exception vector table, and outputs success if so.