CVE-2023-7334

What it is

Changjetong T+ versions up to and including 16.x contain a .NET deserialization vulnerability in an AjaxPro endpoint that can lead to remote code execution. A remote attacker can send a crafted request to /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore with a malicious JSON body that leverages deserialization of attacker-controlled .NET types to invoke arbitrary methods such as System.Diagnostics.Process.Start. This can result in execution of arbitrary commands in the context of the T+ application service account. Exploitation evidence was observed by the Shadowserver Foundation as early as 2023-08-19 (UTC).

At a glance

Exploitability

Can be exploited over the network without logging in. High risk of data exposure, data tampering, service disruption.

Exploit odds

1.1% chance of exploitation in the next 30 days (EPSS).

Fix

No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

1. 2026-01-15 22:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-06-17 06:52 UTC Last updatedMost recent change to the record

Details

Published

2026-01-15 22:16 UTC

Last modified

2026-06-17 06:52 UTC

Exploit probability

1.1% · EPSS, next 30 days

Weakness

CWE-502 · Unsafe deserialization

Record status

Analyzed

Affected

• Chanjetvip t\+ ≤ 16.000.000.0283

Attack profile CVSS 4.0 · 9.3

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High