Junos Space CVE-2025-59989

Exploitation requires (1) the attacker to inject script tags into the Junos Space Device Discovery page and (2) a separate, higher-privileged user - explicitly an administrator - to subsequently visit/render that page (UI:A), at which point the script runs with that victim's permissions. This is NOT default-config unauthenticated RCE: it is an interaction-dependent XSS limited to running in the victim's authenticated management session. Limiting factors that reduce realistic risk: the mandatory victim interaction, the need for the attacker to reach and store content in the Device Discovery workflow (plausibly requiring authenticated access despite the vendor's PR:N), and that the payload only inherits an existing user's privileges rather than granting new host-level access. Affects all Junos Space versions prior to 24.1R4.

This is a medium-severity stored/reflected cross-site scripting flaw (CVSS 4.0 base 5.1, CWE-79) whose real-world priority is moderate-to-low. The signals are internally consistent and point away from urgent mass-exploitation: EPSS is 0.24% (13th percentile), it is NOT on the CISA KEV list, and no public exploit code is referenced - only the vendor advisory (JSA103140). The CVSS vector (AV:N/AC:L/PR:N/UI:A) shows a network-reachable, low-complexity bug, but exploitation REQUIRES active user interaction (UI:A) - specifically an authenticated operator or administrator must visit the malicious Device Discovery page - and impact is capped at low confidentiality/integrity on a subsequent system (VC:N/VI:N/VA:N, SC:L/SI:L) rather than full code execution on the host. CONFLICTING SIGNAL TO VERIFY: the vendor vector sets PR:N (no privileges), yet injecting script tags into the Device Discovery page of a management platform plausibly requires some authenticated access to the Junos Space UI; this PR:N vs. likely PR:L discrepancy should be confirmed with Juniper. The headline phrase 'execute commands with the target's permissions, including an administrator' describes a session-riding consequence of the XSS, not independent RCE - net real risk is elevated only where an admin can be socially engineered into the vulnerable page.

An attacker plants malicious script tags that are stored and rendered by the Junos Space Device Discovery page, then lures a higher-privileged user - ideally an administrator - into viewing it. When the admin's browser renders the page, the script executes in their authenticated session and issues management actions with the admin's permissions. No public exploit code is referenced, and exploitation depends on the victim actually visiting the page (UI:A).