Juniper Junos Space CVE-2025-60001

Requires an unpatched Junos Space instance (any version before 24.1R4) and the attacker must be able to inject script tags into the Generate Report page of the web management interface. Exploitation is NOT self-contained: a second user must actively visit the poisoned report page (UI:A) for the payload to execute, and the impact severity scales with that victim's privilege level (maximal if an administrator). Limiting factors: dependence on a privileged victim interacting with the crafted page, the non-default state of an attacker-injected report, and exposure only via the Junos Space web UI. The listed PR:N implies unauthenticated injection, but the report-generation context suggests the attacker likely needs interface/account access - verify against advisory JSA103140.

This is a moderate, not high-priority, issue. The CVSS 4.0 base score is 5.1 (MEDIUM), driven by network vector (AV:N), low complexity (AC:L), no attack requirements (AT:N), but crucially UI:A - a second user must actively visit the malicious Generate Report page for the stored script to fire. The vendor scored all vulnerable-system impacts as none (VC:N/VI:N/VA:N) and only subsequent-system confidentiality/integrity as low (SC:L/SI:L), reflecting that execution occurs in the victim's browser/session context rather than directly compromising the platform. No EPSS score, CISA KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The headline risk - 'execute commands with the target's permissions, including an administrator' - means a successful hit against an admin could escalate to full management-platform control, but this depends on a chain of conditions (attacker injection access + admin victim visiting the page). The single notable conflict: the vector lists PR:N (unauthenticated) yet the described action requires injecting content into an authenticated report-generation workflow, which typically presumes an account; treat PR:N as optimistic and verify with vendor advisory JSA103140.

An attacker with access to the Junos Space web interface injects malicious script tags into the Generate Report page. When another user - ideally an administrator - subsequently views that report page, the stored script executes in their authenticated session and performs actions with their privileges. No public exploit code is identified at time of analysis, and the attack is gated on a privileged victim actually opening the poisoned page.