Gigabyte Control Center contains an arbitrary file write flaw that allows an unauthenticated remote attacker, when the pairing feature is enabled, to write files to any path on the host operating system. This flaw can be leveraged to place malicious executables or overwrite system files, thereby enabling remote code execution or privilege escalation. The weakness is classified as CWE‑23 (Path Traversal) and CWE‑787 (Out‑of‑Bounds Write).

The vulnerability affects Gigabyte's Control Center software. Users running versions earlier than 25.12.10.01 are impacted. The affected product is identified by the vendor GIGABYTE and the product Gigabyte Control Center.

The CVSS base score of 9.2 indicates critical severity, while the EPSS score of less than 1% suggests a low probability of exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalog, implying no publicly known active exploits, but the attack vector is remote and requires no authentication, making it highly attractive for attackers. Exposing the pairing feature likely allows the attacker to send crafted requests to write files on the system, completing the exploit.