CVE-2023-7334 is a critical (9.8) .NET deserialization flaw in Changjetong T+ versions up to and including 16.x. A request to an AjaxPro endpoint can lead to remote code execution as the application service account. The record names no fixed version, so check with the vendor and keep T+ off the internet.
What's affected
The record lists Changjetong T+ (chanjetvip) versions up to and including 16.x. The affected component is an AjaxPro endpoint under the /tplus/ajaxpro path, in a method that fetches warehouse data by store.
The record says commands run in the context of the T+ application service account, and notes that the Shadowserver Foundation saw evidence of exploitation as early as 19 August 2023. The CVE is not on the CISA Known Exploited list at the time of writing, so treat the Shadowserver note as the record states it and nothing more.
The CVSS vector is AV:N/AC:L/PR:N/UI:N. The record does not name a fixed version. The vendor product page is linked in the record, and the vendor is the place to confirm the patched build.
How to check if you're exposed
T+ is a business accounting application installed on a Windows server.
- Identify any T+ servers and their versions from the application itself or from the vendor installer records.
- From inside your network, check whether the server answers on its web port, and whether it is reachable from the internet through firewalls or port forwarding.
- Review web server logs for requests to the AjaxPro path from addresses that are not your users.
- Review the service account for unexpected child processes, new scheduled tasks and new local users.
What to do now
- Find every T+ instance, including ones run by branch offices.
- Remove internet exposure. Put T+ behind a VPN or a gateway that only allows known users.
- Contact the vendor for a patched build and apply it. The record does not give a version number.
- If the server was reachable from the internet, treat it as possibly compromised and investigate before restoring trust, since the record mentions exploitation evidence.
- Run the T+ service under a low privilege account and restrict its outbound network access.
Why it matters
The weakness is CWE-502, deserialization of untrusted data. The server reads structured input from a request and rebuilds objects from it. When the input is allowed to name which types to build, an attacker can choose types that do something harmful during or after construction.
Accounting systems hold the financial data of a company, and a foothold on the server is a foothold in the network. Deserialization bugs are common in older .NET libraries that map JSON to types by name. The long term fix is to stop accepting type names from the client.
Quick check
Is it on the CISA KEV list?
No. The record marks KEV as false. The record itself says the Shadowserver Foundation observed exploitation evidence from August 2023.
Sources
Last reviewed: 19 October 2026.
