Junos Space CVE-2025-59996

Exploitation requires the attacker to first store malicious script tags in content rendered by the Junos Space Configuration View page, and then requires a separate user to open that page for the payload to fire (UI:A / victim interaction). The impact scales with the victim's privilege level - commands run with the viewing user's permissions, so maximum impact occurs only when an administrator visits the poisoned page. Limiting factors: this is not self-executing (no automatic triggering), it depends on luring or waiting for a privileged user, and it affects only Junos Space versions before 24.1R4; upgrading to 24.1R4 removes the condition. The vendor's PR:N rating implies no authentication to inject, but the injection surface is a management-console configuration page, so defenders should confirm what access level is actually needed to store the payload.

This is a stored cross-site scripting (CWE-79) flaw in the Junos Space Configuration View page, reported by Juniper's own SIRT. The signals converge on moderate, not critical, risk. The vendor CVSS 4.0 score is 5.1 (medium) with no impact to the vulnerable system itself (VC:N/VI:N/VA:N) and only low confidentiality/integrity impact to a subsequent system (SC:L/SI:L) - consistent with a client-side script-injection bug rather than direct server compromise. EPSS is low at 0.22% (12th percentile), the CVE is NOT on CISA KEV, and no public exploit is referenced, so there is no public exploit identified at time of analysis. The most important caveat: exploitation is gated by UI:A - a legitimate user, ideally an administrator, must actually visit the poisoned Configuration View page for the injected script to run with their privileges. One notable tension in the data: the vendor vector states PR:N (unauthenticated), yet stored XSS into a management-console Configuration View realistically presupposes some level of access to submit the malicious input; this should be verified with Juniper, as it materially changes the threat model. Net: a real but not top-priority issue - meaningful because successful exploitation can yield administrator-level command execution within Junos Space, but tempered by low exploitation probability, required victim interaction, and no evidence of active exploitation.

An attacker injects script tags into a field rendered by the Junos Space Configuration View page. When another user - ideally an administrator - later opens that page, the stored script executes in their authenticated session and issues commands with their permissions. No public proof-of-concept is referenced, and the attack cannot proceed until a privileged user views the affected page.