Juniper Junos Space CVE-2025-59988

Exploitation requires (1) the ability to inject script into the Junos Space Generate Report page, and (2) a second, higher-privileged user - ideally an administrator - subsequently opening that report (UI:A is mandatory). Limiting factors: the payload only fires when a victim views the crafted report, impact is confined to the privileges of that viewing user, and all Junos Space versions before 24.1R4 are affected (fixed in 24.1R4). Although the vendor marks PR:N, reaching the report-generation function in a network-management console plausibly requires some authenticated session, which further constrains attacker reach.

This is a stored/injected cross-site scripting flaw (CWE-79) in the Generate Report page of Juniper Junos Space, scored by the vendor at CVSS 4.0 5.1 (medium). The vendor 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) models zero direct impact on the vulnerable system itself and only Low confidentiality/integrity impact on the subsequent system (the victim's browser/session) - consistent with XSS where impact lands on whoever views the malicious report. All exploitation signals point to low real-world urgency: EPSS is 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit code is referenced - so this is no public exploit identified at time of analysis. The notable escalation factor is the description's claim that a viewing user, 'including an administrator,' can be made to 'execute commands with the target's permissions,' which elevates this above a trivial pop-up XSS toward session-riding of privileged UI actions. One tension to verify with the vendor: the vendor vector uses PR:N, yet injecting persistent script into a Generate Report page typically presupposes some authenticated access to the management console - so true unauthenticated reachability of the injection point should be confirmed. Net: a genuine but medium-priority issue - patch in normal cycles rather than as an emergency, with priority raised if administrators routinely open user-generated reports.

An attacker with access to the Junos Space web console injects a script payload into the Generate Report page; when another operator - potentially an administrator - opens that report, the script executes in their authenticated session and performs management actions with the victim's privileges. No public exploit code is referenced, and successful execution depends on a privileged user actually viewing the poisoned report (UI:A).