Juniper Junos Space CVE-2025-59986

Requires the ability to create or edit a Model Devices entry in the Junos Space web UI and to store script content in one of its input fields; the vendor vector marks this PR:N (unauthenticated), but the feature is normally an authenticated management operation, so verify reachability without credentials. Exploitation further requires that another user - ideally an administrator - subsequently open/view the poisoned entry (UI:A), making this a targeted rather than automatable attack. Impact scales with the viewing user's privileges; it affects all Junos Space versions before 24.1R4 and is remediated in 24.1R4.

This is a stored cross-site scripting (CWE-79) flaw in Juniper Junos Space with a vendor-assigned CVSS 4.0 base score of 5.1 (Medium). The signals converge on a modest-but-real priority rather than an emergency. Exploitation status: no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is very low at 0.22% (12th percentile), indicating no observed or predicted widespread exploitation. The CVSS 4.0 vector shows network attack vector (AV:N), low complexity (AC:L), and only subsequent-system confidentiality/integrity impact at Low (SC:L/SI:L) with no impact to the Junos Space system itself (VC/VI/VA:N) - consistent with XSS executing in a victim's browser rather than compromising the server directly. Two signals are in tension and should be verified: the vector asserts PR:N (unauthenticated), yet the description requires an attacker to 'inject script tags in the input fields in Model Devices,' which in Junos Space is an authenticated management operation - verify with Juniper whether Model Device creation is reachable without authentication. The vector also requires UI:A (a victim must view the poisoned page), which materially limits automated/mass exploitation. The payoff, however, is significant: if a targeted victim is an administrator, the injected script executes commands with that administrator's permissions, effectively escalating a lower-privileged injector to admin-equivalent actions within the management plane.

An attacker with access to the Junos Space Model Devices feature stores a malicious <script> payload in an input field of a model device entry. When an administrator later opens that entry in the Junos Space web console, the script executes in the admin's authenticated session and issues management actions with administrator permissions. No public proof-of-concept is known, and success depends on a privileged user actually viewing the poisoned record (UI:A).