Juniper Junos Space CVE-2025-59976

Requires a valid low-privileged authenticated session on the Junos Space web interface (PR:L) - exploitation is not possible pre-authentication. No special non-default configuration is indicated: the issue affects all versions of Junos Space before 24.1R3 in their normal web-interface deployment, exploited by sending crafted GET requests that defeat the JBoss daemon's file-path restrictions. The main limiting factors are (1) the attacker must already possess or obtain credentials of at least a low-privileged user, and (2) impact is read-only disclosure of files accessible to the JBoss daemon - there is no integrity or availability impact. No user interaction is required.

This is a moderate-severity information disclosure flaw (CWE-552) with a vendor-assigned CVSS 4.0 base score of 7.1. The vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation requiring only low-privileged authentication and no user interaction, with impact confined to confidentiality (VC:H; VI:N/VA:N). Signals are internally consistent and point to a real but bounded risk: the EPSS score is low at 0.29% (19th percentile), the CVE is NOT listed in CISA KEV, and no public exploit code was identified in the provided data, so there is no evidence of active or imminent widespread exploitation. The primary driver of priority is that the flaw lets an already-authenticated low-privilege user escalate their read access to arbitrary files on the system - a meaningful privilege/trust-boundary bypass on a network management platform that often stores credentials and device configurations. Net assessment: a legitimate patching priority for Junos Space operators because the attacker barrier is low once any account exists, but not an emergency given low EPSS, no KEV listing, and no known public POC. The requirement for valid (even low-privileged) authentication is the main factor keeping real-world risk below the raw score.

An attacker who holds any low-privileged account on the Junos Space web interface (or who has phished/obtained such credentials) sends a specially crafted GET request that abuses path handling in the JBoss daemon to traverse outside the normally permitted file path. They retrieve sensitive files - such as configuration data or credentials - that their account level should not be able to read. No public exploit code was identified at time of analysis, and the low complexity (AC:L) means a working request requires little specialized tooling once access exists.