{"id":"CVE-2026-4415","state":"PUBLISHED","title":"GIGABYTE｜Gigabyte Control Center - Arbitrary File Write","description":"Gigabyte Control Center developed by GIGABYTE has an Arbitrary File Write vulnerability. When the pairing feature is enabled, unauthenticated remote attackers can write arbitrary files to any location on the underlying operating system, leading to arbitrary code execution or privilege escalation.","publishedAt":"2026-03-30T07:36:16.066Z","updatedAt":"2026-03-31T03:55:38.063Z","severity":{"score":9.2,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"twcert"},"assigner":"twcert","products":["GIGABYTE Gigabyte Control Center"],"affected":[{"vendor":"GIGABYTE","product":"Gigabyte Control Center","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"25.07.21.01","versionType":"custom"}]}],"references":["https://www.twcert.org.tw/tw/cp-132-10803-ae014-1.html","https://www.twcert.org.tw/en/cp-139-10804-689cd-2.html"],"weaknesses":["CWE-23"],"ingestedAt":"2026-10-29T20:12:16.098Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/4xxx/CVE-2026-4415.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-4415","state":"PUBLISHED","datePublished":"2026-03-30T07:36:16.066Z","dateUpdated":"2026-03-31T03:55:38.063Z","assignerShortName":"twcert","assignerOrgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateReserved":"2026-03-19T02:53:07.470Z"},"containers":{"cna":{"title":"GIGABYTE｜Gigabyte Control Center - Arbitrary File Write","descriptions":[{"lang":"en","value":"Gigabyte Control Center developed by GIGABYTE has an Arbitrary File Write vulnerability. When the pairing feature is enabled, unauthenticated remote attackers can write arbitrary files to any location on the underlying operating system, leading to arbitrary code execution or privilege escalation."}],"affected":[{"vendor":"GIGABYTE","product":"Gigabyte Control Center","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"25.07.21.01","versionType":"custom"}]}],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-10803-ae014-1.html","tags":["third-party-advisory"]},{"url":"https://www.twcert.org.tw/en/cp-139-10804-689cd-2.html","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"CRITICAL","baseScore":9.2,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"HIGH","baseScore":8.1,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-23","lang":"en","description":"CWE-23 Relative path traversal","type":"CWE"}]}],"providerMetadata":{"shortName":"twcert","orgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateUpdated":"2026-03-30T07:53:32.519Z"},"datePublic":"2026-03-30T07:32:00.000Z","impacts":[{"capecId":"CAPEC-139","descriptions":[{"lang":"en","value":"CAPEC-139 Relative Path Traversal"}]}],"solutions":[{"lang":"en","value":"Please update to version 25.12.10.01 or later.","supportingMedia":[{"type":"text/html","base64":false,"value":"Please update to version 25.12.10.01 or later."}]}],"source":{"advisory":"TVN-202603008","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.1"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-30T00:00:00+00:00","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3","id":"CVE-2026-4415"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-31T03:55:38.063Z"}}]}}}