Junos Space CVE-2025-59982

Exploitation requires the attacker to inject script tags into the Junos Space dashboard search field, and - per the CVSS UI:A metric - depends on a second user (ideally an administrator) subsequently visiting/viewing the dashboard where the payload renders; the script then runs only with that victim's privileges. Limiting factors: mandatory victim interaction, impact confined to the victim's browser session rather than the appliance itself, and remediation available in Junos Space 24.1R4 (all prior versions affected). The description's reference to injecting a persistent payload into the authenticated management console's search field suggests at least console access is required despite the vendor's PR:N rating.

This is a stored/reflected cross-site scripting flaw (CWE-79) in the Junos Space dashboard search field, rated CVSS 4.0 5.1 (Medium) by Juniper. All signals point to genuinely moderate - not critical - risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) shows network reach and low complexity but critically requires victim interaction (UI:A): a legitimate user, ideally an administrator, must view the injected payload for it to fire. Impact is confined to the subsequent system (SC:L/SI:L) - i.e. the victim's authenticated session - with no direct confidentiality, integrity, or availability impact to the Junos Space host itself (VC:N/VI:N/VA:N). EPSS is low at 0.27% (18th percentile), there is no CISA KEV listing, and no public exploit was identified, so all exploitation signals are consistent and align with the modest CVSS. The one point requiring verification: Juniper rated this PR:N (unauthenticated), yet the description describes injecting a persistent payload into the dashboard search field that other users later visit, which typically implies at least low-privileged authenticated access to reach and store content in the management console - this PR:N vs. likely PR:L discrepancy should be verified against the vendor advisory. Net: a real but low-priority issue best handled through routine patching rather than emergency response.

A low-privileged (or, per Juniper's rating, unauthenticated) attacker injects malicious script tags into the Junos Space dashboard search field. When an administrator or other user subsequently views the dashboard containing the payload, the script executes in their browser session, allowing the attacker to perform actions and run commands with that victim's permissions - up to administrator level. No public proof-of-concept exploit has been identified at the time of analysis.