Juniper Junos Space CVE-2025-59998

Exploitation targets the Junos Space web UI 'Archive Log' screen specifically: the attacker must get script tags stored in content that this screen renders, and a second user - ideally an administrator - must actively open that screen for the payload to execute (UI:A is the primary limiting factor). The CVSS vector lists PR:N, implying no authentication is required to plant the payload, though the precise log-injection path is not described and should be confirmed with Juniper. Affected deployments are any Junos Space instance before 24.1R4; the issue is fixed in 24.1R4. Impact is bounded to actions performable within the victim's authenticated session (SC:L/SI:L) and does not directly compromise the underlying appliance OS.

This is a medium-severity stored cross-site scripting flaw (CVSS 4.0 base 5.1, vendor-assigned by Juniper SIRT) whose signals consistently point to moderate, not critical, real-world risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) indicates a network-reachable, low-complexity issue, but exploitation is gated by UI:A - a legitimate user (ideally an administrator) must actively visit the Archive Log screen for the injected script to fire. Impact is confined to the subsequent system (victim's session/browser) at SC:L/SI:L with no direct impact on the vulnerable host itself (VC:N/VI:N/VA:N), consistent with XSS rather than direct code execution on the appliance. EPSS is low (0.22%, 12th percentile), there is no CISA KEV listing and no public exploit identified, so there is no evidence of widespread or active exploitation. The description's claim that an attacker can 'execute commands with the target's permissions, including an administrator' describes script-in-session abuse (acting as the victim via the web UI), not unauthenticated remote code execution - do not over-read this as RCE. One point to verify: the vector states PR:N (no privileges to inject), which is plausible if attacker-controlled data reaches the archive log without authentication, but the exact injection path is not detailed in the available data - confirm with Juniper whether log entries can be poisoned by an unauthenticated actor.

An attacker injects crafted script tags into data that is rendered on the Junos Space Archive Log screen. When an administrator later opens that screen, the stored script executes in the admin's authenticated session and performs actions in the Junos Space UI with the administrator's privileges. No public exploit code has been identified, and success depends on an admin actually viewing the poisoned log screen (UI:A).