Juniper Junos Space CVE-2025-59999

Exploitation requires the attacker to store a malicious script into a field on the Junos Space API Access Profiles page, and then requires a second privileged user (such as an administrator) to visit that page for the payload to fire (UI:A / stored XSS). Limiting factors: (1) mandatory victim interaction - no impact until a privileged user loads the affected page; (2) the vendor's PR:N notwithstanding, injecting into the API Access Profiles configuration area realistically implies the attacker already has some authenticated access to write that profile, narrowing the attacker population to users who can reach and modify that admin page; (3) affected scope is limited to Junos Space instances running any version before 24.1R4 (24.1R1/R2/R3 explicitly enumerated in the CPE list). Upgrading to 24.1R4 or later removes the condition.

This is a stored/persistent cross-site scripting flaw (CWE-79) in the API Access Profiles page of Juniper Junos Space, rated by the vendor at CVSS 4.0 5.1 (Medium). The signals are mutually consistent in pointing to a MODERATE, non-urgent priority rather than a top-tier emergency: EPSS is very low at 0.24% (13th percentile), the issue is NOT on the CISA KEV list, and no public proof-of-concept was provided in the input. Exploitation status is therefore 'no public exploit identified at time of analysis.' The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) describes network reach and low complexity but critically requires victim interaction (UI:A) - a privileged user must visit the poisoned page - which caps real-world impact and makes this a targeted, social-engineering-dependent vector rather than a wormable or automatable one. The impact metrics are limited to the subsequent system (SC:L/SI:L, with VC/VI/VA all N on the vulnerable system), reflecting session-level script execution rather than direct data loss. CONFLICT TO VERIFY: the vendor's vector sets PR:N (unauthenticated), yet the description states the payload is injected into the API Access Profiles configuration page - an administrative area that normally requires an authenticated session to write to. This suggests the attacker may in fact need at least low-privilege authenticated write access to plant the script, so the PR:N rating is questionable and should be confirmed with Juniper. Net: a genuine but non-critical, interaction- and likely access-gated vulnerability affecting a management platform; patch on a normal cycle, not a fire drill.

An attacker with the ability to write to the API Access Profiles page injects malicious <script> tags into a profile field. When an administrator or other privileged user later opens that page in the Junos Space web UI, the stored script executes in their authenticated browser session and performs actions with the victim's permissions, including administrator-level operations. No public exploit code was identified, and successful exploitation depends on a privileged user visiting the poisoned page (UI:A).