Juniper Junos Space CVE-2025-59978

Exploitation requires the attacker to hold a valid low-privileged authenticated account on Junos Space (CVSS PR:L) with the ability to submit input into a field that is persistently stored and rendered back in another user's web page. The payload only triggers when a higher-privileged victim - an administrator - subsequently views the affected page in their browser (CVSS UI:P), meaning no impact occurs without that victim interaction. All versions of Junos Space prior to 24.1R4 are affected, so the limiting factors are: valid authentication, an interface that stores and reflects attacker input, and a privileged user viewing the content; there is no indication a non-default configuration is required.

This is a genuinely high-priority flaw with mitigating factors worth weighing. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P, score 9.4) describes a network-reachable, low-complexity stored XSS requiring only low attacker privileges (PR:L) but passive victim interaction (UI:P) - the victim must view the poisoned page. The VC:H/VI:H/VA:H plus subsequent-system SC:H/SI:H/SA:H impact ratings reflect that the injected script executes with the viewing user's administrative permissions on Junos Space, a network-management platform, so successful exploitation can cascade to managed infrastructure. Countering that severity, EPSS is only 0.53% (43rd percentile), the CVE is NOT on CISA KEV, and no public exploit was provided - so there is no evidence of active or widespread exploitation. The high CVSS is driven by the administrative impact and network vector, not by observed attack activity; this is a real patch priority for Junos Space operators but currently reflects potential rather than demonstrated risk. Note the authenticated prerequisite (PR:L) and required victim interaction (UI:P) meaningfully narrow the realistic attacker population versus an unauthenticated worm-class bug.

A low-privileged authenticated Junos Space user injects a malicious <script> payload into a stored field that is later rendered in another user's browser. When an administrator subsequently views that page, the script executes in the admin's authenticated session and issues commands with full administrative permissions. No public proof-of-concept exploit was provided in the available data.