Junos Space CVE-2025-59987

Exploitation requires that a victim who is a logged-in Junos Space user - ideally an administrator - view attacker-controlled content rendered in the device search field, at which point the injected script executes in that user's authenticated browser session (UI:A is the explicit limiting factor). The impact is bounded to actions the victim is authorized to perform in Junos Space; there is no direct confidentiality/integrity/availability impact to the underlying host (VC/VI/VA:N). Affected: all Junos Space versions before 24.1R4; upgrading to 24.1R4 or later removes the condition. The requirement for a privileged victim to interact meaningfully limits mass/opportunistic exploitation.

This is a moderate, not critical, priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:A) with only subsequent-system low impacts (SC:L/SI:L, VC/VI/VA all N) yields a base score of 5.1 (medium), which is consistent with a cross-site scripting flaw whose impact lands in a victim's browser session rather than the server itself. Exploitation signals are weak and mutually consistent: EPSS is 0.22% (12th percentile), the CVE is NOT on CISA KEV, and no public exploit is identified - so there is no public exploit identified at time of analysis. The one aggravating factor is the described consequence: script execution in the context of a logged-in user who may be an administrator of a network-management platform, which could translate XSS into privileged actions against managed Juniper devices. The key caveat is PR:N combined with UI:A: the vector models an unauthenticated attacker whose payload must be rendered to a victim who takes an action (classic reflected/stored XSS delivery). The description's phrasing ('inject script tags in the arbitrary device search field') does not make clear whether injecting the payload itself requires an authenticated session in the Junos Space console - verify the delivery path with Juniper advisory JSA103140, as this materially affects whether PR:N is justified.

An attacker crafts a malicious script payload targeting the Junos Space device search field and lures an authenticated Junos Space operator or administrator into viewing it (e.g., via a crafted link or a planted search entry). When the victim's browser renders the field, the injected script runs in their session and can issue commands with that user's permissions, including administrative actions. No public exploit code is known, and successful exploitation requires the victim to take an action (UI:A).