Junos Space CVE-2025-59992

Exploitation requires the attacker to inject script tags into the Junos Space Secure Console page AND a separate authenticated user - such as an administrator - to subsequently visit that page (CVSS UI:A, active user interaction). The payload runs with the victim's permissions and can execute console commands, so impact scales with the viewing user's role. Limiting factors: the attack is not self-executing and depends on victim interaction with the specific Secure Console feature; it affects only Junos Space instances running versions before 24.1R4; and although the vector lists PR:N, the Secure Console is an authenticated management interface, so the ability to plant the script may in practice require some level of access - a limiting factor defenders should confirm with Juniper.

This is a medium-severity stored/DOM cross-site scripting flaw (CWE-79) in the Junos Space Secure Console page, vendor-scored CVSS 4.0 5.1. Multiple signals converge on LOW real-world urgency: EPSS is 0.22% (12th percentile), the CVE is NOT in CISA KEV, and no public exploit code has been identified - so exploitation is neither confirmed nor demonstrated. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) indicates a network-reachable, low-complexity attack with no attacker privileges required but ACTIVE user interaction needed: a victim must visit the poisoned Secure Console page. Impact is modeled as subsequent-system only (SC:L/SI:L, VC/VI/VA all N), meaning the damage occurs in the victim's authenticated session rather than directly against the base component. The notable tension is between the PR:N rating (implying unauthenticated injection) and the nature of the flaw - the Secure Console is an authenticated management interface, so the ability to plant script tags plausibly presumes some prior access; the description does not clarify this, so the injection-point privilege requirement should be verified with Juniper. No SSVC decision data was provided. Net: a legitimate issue worth patching on the normal cycle, elevated by the admin-session-hijack potential, but not an emergency - there is no evidence of active or automated exploitation.

An attacker plants malicious <script> tags into the Junos Space Secure Console page; when an administrator or other operator later opens that page, the script executes in their authenticated browser session and issues console commands with that user's privileges, up to full administrator. No public proof-of-concept is known, and success hinges on the targeted user actually viewing the poisoned page (UI:A).