Junos Space CVE-2025-59997

Exploitation requires the attacker to inject script tags into the CLI Configlets pages of Junos Space, and a second user - ideally an administrator - must subsequently open that Configlets page for the payload to fire (UI:A, active user interaction). The feature-specific prerequisite is use of the CLI Configlets functionality; impact scales with the privileges of the victim who views the page, with administrator sessions yielding command execution at administrator level. Limiting factors: the requirement for a victim to visit the page, the likely need for some level of access to author/store a configlet (despite the vector's PR:N), and the confinement of impact to the affected Junos Space web session. Affected: all Junos Space versions before 24.1R4.

This is a stored cross-site scripting (CWE-79) flaw in the Junos Space CLI Configlets feature, rated MEDIUM at CVSS 5.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A). Multiple low-risk signals converge: EPSS is only 0.22% (12th percentile), it is NOT on CISA KEV, and no public exploit code was identified in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The CVSS 4.0 vector reports PR:N (unauthenticated), but this CONFLICTS with the description, which describes injecting script tags into the CLI Configlets administrative pages - a feature that in practice requires an authenticated session to populate; verify the true privilege requirement with Juniper (JSA103140). The vector also requires active user interaction (UI:A): a second user, ideally an administrator, must visit the poisoned page, and impact is confined to the victim's browser session (VC:N/VI:N/VA:N but subsequent-system SC:L/SI:L). Net assessment: a genuine but lower-priority stored-XSS privilege-escalation issue - real because it can yield admin-equivalent command execution, but gated by user interaction and likely some level of access, and not currently showing signs of active or widespread exploitation.

An attacker with access to the Junos Space CLI Configlets functionality embeds malicious <script> tags in a configlet. When a legitimate administrator later opens the affected Configlets page, the script executes in the admin's authenticated browser session and silently issues commands with that administrator's privileges. No public proof-of-concept was identified in the provided data, and success depends on the targeted user actually viewing the poisoned page (UI:A).