Gigabyte Control Center contains a relative path traversal vulnerability (CWE-23) that enables unauthenticated remote attackers to perform arbitrary file writes on the host system when the pairing feature is enabled. This can result in execution of arbitrary code or escalation of privileges. The vulnerability is remotely exploitable without user interaction and requires no privileges, making it highly critical. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows attackers to write files anywhere on the underlying operating system, potentially leading to arbitrary code execution or privilege escalation. This can compromise the affected system's security, confidentiality, and integrity. Given the unauthenticated remote access and high impact, this vulnerability poses a critical risk to affected systems running the vulnerable Gigabyte Control Center with the pairing feature enabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable the pairing feature in Gigabyte Control Center to prevent exploitation. Monitor vendor communications for updates on patches or official mitigations.