Juniper Junos Space CVE-2025-59993

Exploitation requires the attacker to write a script payload into Junos Space 'Space Node Setting' fields, and then requires a second user - specifically a higher-privileged user such as an administrator - to subsequently view the page rendering that field (UI:A / victim interaction is mandatory). Limiting factors: this is not a drive-by server compromise - impact is confined to the viewing user's session, so damage depends on which user is socially or operationally induced to view the injected content; affected deployments are Junos Space before 24.1R4. Although the vendor vector lists PR:N, injecting into management Node Setting configuration fields realistically presupposes access to the management interface, which narrows the practical attacker population below 'anonymous internet-wide.'

This is a stored/persistent cross-site scripting flaw (CWE-79) in Juniper Junos Space, rated by the vendor at CVSS 4.0 5.1 (Medium). The 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) indicates a network-reachable, low-complexity attack with no stated privileges but requiring victim interaction (UI:A - a user must view the malicious Node Setting field). Impact is limited: VC:N/VI:N/VA:N on the vulnerable system itself, with only subsequent-system confidentiality and integrity impact (SC:L/SI:L), consistent with script executing in the victim's authenticated browser session rather than directly compromising the server. Real-world exploitation signals are LOW: EPSS is 0.22% (12th percentile), the CVE is NOT in CISA KEV, and no public proof-of-concept is referenced. One signal CONFLICTS with the description: the vector asserts PR:N (unauthenticated), yet the description states the payload is injected into 'Space Node Setting fields' - a management-plane configuration area that in practice requires an authenticated session to write to, so the true attacker-side prerequisite is likely some authenticated access rather than fully anonymous - verify with vendor advisory JSA103140. The notable upside for an attacker is privilege escalation: if an administrator views the injected field, commands run with administrator permissions. Net: this is a genuine but not urgent issue - a medium-severity, interaction-dependent XSS with no evidence of active or automated exploitation; prioritize routine patching, not emergency response.

An attacker places malicious script tags into a Junos Space Node Setting field. When another user - ideally an administrator - later opens the affected management page, the stored script executes in their authenticated session and runs actions with their privileges. No public exploit code is referenced, and success depends on a privileged user actually viewing the poisoned field.