Juniper Junos Space CVE-2025-59981

Exploitation requires the attacker to inject script tags into the Device Template Definition page of Junos Space, which presupposes the ability to create or edit device template definitions in the management console. A second, separate user - ideally an administrator - must then visit that page for the stored payload to execute (UI:A). Limiting factors: the attack is passive-interaction-dependent (no effect until a victim views the page), is confined to users of the Junos Space web UI with template access, and only yields the privileges of whichever user triggers it; it affects all versions before 24.1R4 and is remediated by upgrading to 24.1R4.

This is a stored (persistent) cross-site scripting flaw (CWE-79) in Junos Space's Device Template Definition page, vendor-scored CVSS 4.0 5.1 (Medium). Real-world risk is moderate and context-dependent, not an emergency. Supporting signals: EPSS is 0.27% (18th percentile) - low predicted exploitation probability; there is no CISA KEV listing and no public exploit identified at time of analysis, so exploitation is neither confirmed nor demonstrated. The 4.0 vector (VC:N/VI:N/VA:N, SC:L/SI:L) correctly reflects that the vulnerable system itself is not directly compromised; impact lands on a subsequent system - the victim's authenticated session, potentially an administrator's. CONFLICT TO VERIFY: the vendor vector sets PR:N (unauthenticated), yet a stored XSS that requires injecting script into the Device Template Definition page realistically requires some authenticated access to create/edit template definitions - PR:L is more defensible; verify the exact access model with Juniper. Also note UI:A (passive user interaction) means a victim must view the poisoned page, which bounds automatability. Net: a credible privilege-escalation/session-hijack vector within Junos Space, but gated by required user interaction and (likely) prior platform access, keeping it below high-priority absent evidence of active exploitation.

A lower-privileged Junos Space user with access to the Device Template Definition feature injects malicious script tags into a template definition. When an administrator later views that page, the script executes in the admin's authenticated browser context and issues commands with administrator permissions, effectively escalating the attacker's privileges. No public exploit code is identified at time of analysis.