Junos Space CVE-2025-60000

Exploitation requires an attacker to inject script tags into the Junos Space 'Generate Report' page AND a separate, higher-privileged victim user (explicitly including an administrator) to subsequently visit that page - this victim interaction (UI:A) is the primary limiting factor and means the attack cannot succeed autonomously. It affects all Junos Space versions before 24.1R4 (24.1R1, R2, R3 enumerated in CPE); upgrading to 24.1R4 removes the condition. The vendor vector lists PR:N, but access to the report-generation feature of this management platform is itself a practical prerequisite; the blast radius is bounded to actions the lured user is authorized to perform in the Junos Space web interface.

This is a stored/reflected cross-site scripting flaw (CWE-79) in the Junos Space 'Generate Report' page, rated medium (CVSS 4.0 base 5.1). Multiple signals converge on LOW-to-MODERATE real-world urgency rather than emergency priority. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:A) indicates network reachability and low attack complexity but REQUIRES active user interaction (UI:A) - the injected script only fires when another user, potentially an administrator, opens the affected page. Impact is confined to the subsequent system (SC:L/SI:L) with no direct impact to the vulnerable system itself (VC:N/VI:N/VA:N), reflecting the indirect, browser-context nature of XSS. EPSS is low at 0.22% (12th percentile), and there is no CISA KEV listing and no public exploit identified, so exploitation status is 'no public exploit identified at time of analysis' - consistent with the low EPSS. NOTE A CONFLICT TO VERIFY WITH VENDOR: the vendor vector asserts PR:N (unauthenticated), yet injecting script into a management-platform report-generation page realistically presumes some authenticated foothold; the description does not clarify the attacker's required privilege level. The elevated concern is the stated outcome - 'execute commands with the target's permissions, including an administrator' - meaning a successful lure against an admin could yield administrative actions within Junos Space, which is why this should be patched on a normal cycle rather than ignored, despite modest quantitative scores.

An attacker stores crafted <script> markup in the Junos Space Generate Report workflow; when a higher-privileged user - ideally an administrator - subsequently views that report page, the script executes in their authenticated browser session and performs actions with their permissions. No public exploit code is available, and the attack depends on victim interaction (UI:A), so it is opportunistic/targeted rather than automated mass exploitation.