Critical · published January 15, 2026
🚨 One crafted JSON request can trigger full remote code execution in Changjetong T+ versions up to 16.x! This sneaky .NET deserialization vulnerability is like giving a stranger a master key to your application! 🔥 Think of it as a restaurant where the chef accepts any review without checking the ingredients — a malicious diner could slip in a recipe that leads to disastrous results. In this case, an attacker sends a cleverly crafted request that tricks the application into executing arbitrary commands just like an unverified recipe could ruin a meal. An attacker could gain control over the T+ application service account, allowing them to run any command they desire. This means they could potentially access sensitive data, manipulate system processes, or even take down the entire service. The implications are absolutely devastating for any organization relying on this software!
Think of it as a restaurant where the chef accepts any review without checking the ingredients — a malicious diner could slip in a recipe that leads to disastrous results. In this case, an attacker sends a cleverly crafted request that tricks the application into executing arbitrary commands just like an unverified recipe could ruin a meal. This vulnerability arises from a flaw in the AjaxPro endpoint, allowing attackers to send maliciously crafted JSON data that the .NET framework deserializes without proper validation. This enables them to invoke arbitrary methods, like executing commands through System.Diagnostics.Process.Start.
An attacker could gain control over the T+ application service account, allowing them to run any command they desire. This means they could potentially access sensitive data, manipulate system processes, or even take down the entire service. The implications are absolutely devastating for any organization relying on this software! To protect your system, patch immediately to version 16.1 or higher, where this vulnerability is addressed. Additionally, review your deserialization processes to ensure they only accept trusted data and implement strict input validation to mitigate risks. Don't wait — the time for action is now! You've got this! By following these steps, you’ll be on your way to securing your application in no time! 🛡️