Juniper Junos Space CVE-2025-59995

Exploitation specifically targets the Quick Template page of Junos Space: an attacker must be able to inject/store script tags into a Quick Template, and a second user (per UI:A, ideally an administrator) must then visit that page for the payload to fire in their session. Limiting factors: success depends entirely on a privileged victim opening the attacker-controlled template (no victim view = no impact); impact is bounded to the victim's web-UI session and privileges rather than the underlying host; and realistically the attacker needs prior access to the Junos Space management interface to plant the template, despite the input vector's PR:N. Affected: all Junos Space versions before 24.1R4 (fixed in 24.1R4).

This is a stored/reflected cross-site scripting flaw (CWE-79) in the Quick Template page of Juniper Junos Space, carrying a moderate CVSS 4.0 base score of 5.1. All exploitation signals point to LOW real-world urgency rather than an active priority: EPSS is only 0.22% (12th percentile), the CVE is NOT on CISA KEV, and no public proof-of-concept is identified in the provided data. The exploitation status is therefore 'no public exploit identified at time of analysis.' The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) lists PR:N, meaning the vendor scored it as requiring no privileges, but this conflicts with the description, which implies the attacker must first reach and write to the Quick Template page of an authenticated management application - verify authentication prerequisites with Juniper, as an unauthenticated attacker realistically cannot store a payload in a template. The vector requires UI:A (a second user, ideally an administrator, must visit the poisoned page), which meaningfully limits automatability and makes this targeted rather than opportunistic. Impact is confined to the victim's browser session (SC:L/SI:L in 4.0, i.e. a scope change to a subsequent system) with no direct impact on the vulnerable host itself (VC:N/VI:N/VA:N); the 'execute commands with the target's permissions' phrasing refers to actions in the web UI context, not native code execution. Net: a genuine but low-to-moderate risk best treated as routine patching, elevated modestly because the victim can be an administrator.

An attacker with access to the Junos Space UI stores malicious script tags in a Quick Template, which lie dormant until another operator opens that template. When an administrator subsequently views the poisoned Quick Template page, the injected JavaScript runs in their authenticated session and performs actions with the administrator's permissions. No public exploit code is identified, and successful exploitation depends on an administrator or privileged user actually viewing the crafted template (UI:A).