Juniper Junos Space CVE-2025-59994

Exploitation requires the attacker to inject script tags into the Quick Template page of Junos Space, and a second user - another operator or administrator - must subsequently visit that page for the payload to fire (UI:A / user interaction mandatory). The payload then executes with the viewing victim's permissions, so impact escalates only if an administrator views the tampered template. Practically, injecting the template content implies the attacker holds console access sufficient to create or edit a Quick Template, which limits this to users already inside the management plane rather than fully external actors despite the vendor's PR:N rating. Affects all Junos Space versions before 24.1R4; fixed in 24.1R4. No malicious or non-default networking configuration is otherwise required.

This is a stored cross-site scripting (XSS, CWE-79) flaw in the Junos Space Quick Template page, rated by Juniper at CVSS 4.0 base 5.1 (medium). The vendor vector (AV:N/AC:L/AT:N/PR:N/UI:A) indicates a network-reachable, low-complexity issue requiring victim interaction, with no impact to the vulnerable system itself (VC:N/VI:N/VA:N) but low confidentiality and integrity impact to a subsequent system (SC:L/SI:L) - consistent with script executing in another user's authenticated session rather than compromising the server directly. Real-world urgency signals are LOW and mutually consistent: EPSS is 0.22% (12th percentile), there is no CISA KEV listing, and no public POC is referenced. The one factor that raises concern beyond the modest score is the privilege-escalation potential: the description states the injected script runs 'with the target's permissions, including an administrator,' so a lower-privileged user who can author a template could effectively hijack an admin session. NOTE A DISCREPANCY: the vendor vector sets PR:N (no privileges), but injecting script into a Quick Template realistically requires some authenticated access to the Junos Space management console - PR:N appears optimistic and should be verified with Juniper. Overall this is a genuine but non-urgent, interaction-dependent insider/escalation risk, not a wormable or mass-exploitable threat.

A low-privileged Junos Space user with access to create or edit a Quick Template injects malicious script tags into the template content. When an administrator or other user later opens that Quick Template page, the stored script executes in their authenticated browser session, letting the attacker perform management actions with the victim's (potentially administrator) permissions. No public exploit code is referenced, and successful exploitation depends on the victim viewing the crafted page (UI:A).