Junos Space CVE-2025-59985

Exploitation requires the attacker to write a malicious script payload into a specific field on the Junos Space 'Purging Policy' page, and then requires a second user - ideally an administrator - to view that page for the stored script to execute (UI:A). This is a stored/persistent XSS limited to the Junos Space web management interface on any version before 24.1R4 (24.1R1, R2, and R3 are affected). Although the vendor vector states PR:N, reaching the Purging Policy field in practice presumes access to the management console, so realistic exploitation assumes at least a low-privileged authenticated session plus a privileged victim who visits the page. Impact is confined to the victim's browser session context (execution of commands with the victim's permissions), not direct unauthenticated server compromise.

This is a moderate, lower-priority issue rather than an urgent one. The vendor-assigned CVSS 4.0 score is 5.1 (Medium), and crucially the impact is limited to confidentiality and integrity of a SUBSEQUENT system (SC:L/SI:L) with no availability or vulnerable-system impact - consistent with a stored cross-site scripting flaw that runs in a victim's browser session rather than directly compromising the server. EPSS reinforces low real-world risk: 0.22% probability at only the 12th percentile. The CVE is NOT on CISA KEV and no public exploit is identified, so there is no evidence of active exploitation. One signal to verify: the vendor vector lists PR:N (no privileges), but the attack requires injecting script into a field on the Junos Space 'Purging Policy' administrative page, which in practice implies the attacker already has some authenticated access to the management UI - PR:N likely overstates ease of access, so the realistic prerequisite is a low-privileged authenticated user, not a fully anonymous attacker. The flaw also requires UI:A (a victim, ideally an administrator, must view the malicious page), further limiting opportunistic mass exploitation. Net: a real but conditional privilege-escalation-style XSS in a management plane, best handled on a normal patch cycle unless the Junos Space instance is exposed to untrusted users.

A low-privileged user with access to the Junos Space web console injects a malicious <script> payload into a field on the Purging Policy page. When an administrator later opens that page, the script executes in the administrator's authenticated session and issues management commands with the administrator's permissions. No public proof-of-concept is known, and success depends on luring or waiting for a higher-privileged user to view the affected page (UI:A).