Junos Space CVE-2025-59984

Requires an attacker able to submit input through the Junos Space Global Search feature on an instance running any version before 24.1R4, AND a separate authenticated user (the admin whose privileges the attacker wants) must subsequently view the Global Search results containing the payload - this UI:A requirement is the primary limiting factor. No authentication is required to plant the payload (PR:N), but no impact occurs until a victim renders it; impact is confined to the victim's browser session against the Junos Space web UI, not direct host compromise. Patching to 24.1R4 or later removes the condition.

Real-world risk is moderate-to-low despite the admin-compromise angle. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) describes an unauthenticated, network-reachable, low-complexity injection, but exploitation is gated behind UI:A - a legitimate user (ideally an administrator) must navigate to the poisoned Global Search view for the script to fire. Impact is deliberately scoped as subsequent-system low (SC:L/SI:L, SA:N) with no direct vulnerable-system impact (VC:N/VI:N/VA:N), yielding a vendor score of only 5.1; the description's 'execute commands with the target's permissions, including an administrator' reflects session-context script execution in the browser, not native OS command execution. Exploitation signals are weak: EPSS is 0.22% (12th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, so this is best treated as a routine patch-cycle item rather than an emergency. The main thing elevating it above trivial is that Junos Space is an administrative console - a successful hit against an admin session could enable configuration changes across managed Juniper fabric, so prioritize patching on internet- or multi-user-exposed instances.

An attacker submits a crafted query containing script tags through the Junos Space Global Search feature so the payload is stored/reflected in the search results page. When another authenticated operator - ideally an administrator - subsequently views that Global Search output, the injected JavaScript executes in their browser session and can drive the web UI with their permissions. No public exploit code is known, and success depends on luring or waiting for a higher-privileged user to load the tainted view.