Junos Space CVE-2025-59983

The attacker must be able to write input into the Junos Space 'Template Definition' page (realistically requiring an authenticated session on the management platform, despite the vendor's PR:N rating), and a second user - ideally an administrator - must subsequently visit that page (UI:A/UI required), at which point the stored script executes with that victim's permissions. Limiting factors that reduce real-world risk: exploitation depends on victim interaction (an admin opening the crafted page), the target must be running a vulnerable release (any version before 24.1R4), and Junos Space is an internal network-management appliance not typically exposed to anonymous internet users. No impact occurs without a victim viewing the injected content.

This is a moderate-severity stored cross-site scripting (XSS) issue (CWE-79) rated CVSS 4.0 5.1 by Juniper SIRT. The signals are internally consistent and point to a real-but-not-urgent priority. The vendor vector (AV:N/AC:L/AT:N/PR:N/UI:A) describes a network-reachable, low-complexity flaw requiring victim interaction, with no impact to the vulnerable system itself (VC:N/VI:N/VA:N) but a scope change to the victim's session (SC:L/SI:L) - characteristic of XSS executing in another user's browser. The real danger is privilege context: the description states the injected script can execute commands with the victim's permissions, including an administrator, effectively enabling account/privilege takeover if an admin views the poisoned Template Definition page. The exploitation-likelihood signals are low: EPSS is 0.27% (18th percentile), there is no CISA KEV listing, and no public exploit code was identified. CONFLICT/CAVEAT TO VERIFY: the vendor assigns PR:N, but injecting content into the Template Definition page of an authenticated management platform realistically requires a logged-in (low-privilege) account - treat PR:N with skepticism and verify whether the injection point is reachable pre-authentication. There is no SSVC decision data in the input. Net: a legitimate issue worth patching, but not a drop-everything emergency absent evidence of active exploitation.

A low-privileged authenticated Junos Space user injects a malicious script tag into the Template Definition page. When an administrator later views that page, the script runs in the admin's authenticated session and performs management actions with the admin's permissions. No public proof-of-concept exploit was identified at the time of analysis.