Junos Space CVE-2025-59990

Exploitation requires access to the Junos Space template creation pages to store the malicious script, and critically requires a second user - ideally an administrator - to subsequently view the attacker-controlled template page for the payload to fire (UI:A/active interaction). Limiting factors: this is stored XSS confined to the victim's authenticated management session (SC:L/SI:L, no direct system impact), it needs a privileged victim to view the content to achieve meaningful impact, and despite the vendor's PR:N rating, reaching the template creation function realistically presupposes an authenticated Junos Space account. Affected: all Junos Space versions before 24.1R4 (24.1R1 through 24.1R3 explicitly enumerated); fixed in 24.1R4.

This is a stored cross-site scripting (CWE-79) flaw in Junos Space template creation pages, rated by the vendor (Juniper SIRT) at CVSS 4.0 5.1 (medium). The 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) shows a network vector with low complexity but requires active victim interaction (UI:A) - another user, ideally an administrator, must open the poisoned template page - and impact is confined to the subsequent-system (SC:L/SI:L), i.e. the victim's authenticated session, with no direct impact on the vulnerable system itself. No EPSS score, CISA KEV listing, or public proof-of-concept is present in the supplied data, so exploitation status is: no public exploit identified at time of analysis. One notable conflict: the vendor vector asserts PR:N (unauthenticated), yet the description has the attacker injecting payloads into template creation pages, which in Junos Space is an authenticated management function - the injection step realistically requires some level of authenticated access, so the true attacker privilege is likely PR:L rather than PR:N (verify with vendor advisory JSA103140). The medium score is appropriate: real-world risk is gated by the need for a privileged victim to view attacker-controlled content, making this a targeted, social-engineering-dependent issue rather than a mass-exploitable one, but successful exploitation against an administrator yields command execution with that admin's permissions within the management plane, which is a meaningful privilege-escalation/lateral-movement foothold in a network management platform.

A low-privileged Junos Space user (or an attacker who has compromised such an account) injects a script tag into a template creation page. When an administrator later opens or reviews that template, the stored payload executes in the admin's authenticated browser session, letting the attacker perform management actions with administrator permissions. No public PoC is available, and success depends on luring or waiting for a higher-privileged user to view the malicious template (UI:A).