Juniper Junos Space CVE-2025-59991

Exploitation requires (1) the attacker to inject script tags into the Junos Space Device Management pages - realistically via a device attribute/field rendered in those pages or a managed device the attacker influences, and (2) a second user (operator or administrator) to subsequently visit the affected Device Management page, since the CVSS vector specifies UI:A (active user interaction). Limiting factors: the payload only executes with the victim's privilege level, impact is confined to management-session actions (no direct host confidentiality/integrity/availability impact per VC:N/VI:N/VA:N), the attacker must get a privileged user to open the specific poisoned page, and only Junos Space versions before 24.1R4 are affected.

This is a stored/reflected cross-site scripting flaw (CWE-79) in the Device Management pages of Juniper Junos Space, vendor-rated CVSS 4.0 5.1 (MEDIUM). Multiple signals point to this being a lower-priority issue rather than an urgent threat: EPSS is 0.22% (12th percentile, i.e. low predicted exploitation), it is NOT on the CISA KEV list, and no public exploit code is referenced - so this is 'no public exploit identified at time of analysis.' The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) indicates network reachability and low complexity, but crucially requires active user interaction (UI:A) - a victim, ideally an administrator, must visit the poisoned Device Management page for the payload to fire. The vulnerable-system impact is explicitly none (VC:N/VI:N/VA:N) with only subsequent-system low confidentiality and integrity (SC:L/SI:L), reflecting that damage is bounded by what the victim's browser session can do. CONFLICTING SIGNAL: the vendor sets PR:N (no privileges), yet injecting script into Device Management pages realistically requires either authenticated access to the management console or control over a managed device whose attributes are rendered - verify with vendor whether truly unauthenticated injection is possible. Despite the 'execute commands as an administrator' phrasing, the bounded impact metrics and absence of exploitation evidence make this a patch-in-normal-cycle item, not an emergency.

An attacker with the ability to inject content into a Junos Space Device Management page (e.g., via a crafted device name or attribute, or a managed device under their control) plants a script payload. When a legitimate operator or administrator later opens that Device Management page, the stored script executes in their browser session and issues management actions with that user's privileges. No public exploit code has been identified, and successful exploitation depends on a privileged user actually viewing the affected page.