Juniper Junos Space CVE-2025-60002

Exploitation requires the attacker to store a malicious script tag in the Junos Space Template Definitions page, then requires a second user - ideally an administrator - to actively visit that page (UI:A/required) for the payload to execute in their session. Limiting factors: this is a persistent XSS dependent on victim interaction rather than drive-by, it is scoped to the Junos Space management web interface, impact is bounded to the viewing user's permissions and session (no direct appliance compromise), and injecting the payload plausibly requires at least low-privileged access to the Template Definitions feature despite the vendor's PR:N rating. Only versions before 24.1R4 are affected.

This is a stored/persistent cross-site scripting flaw (CWE-79) in the Junos Space Template Definitions page, rated medium severity (vendor CVSS 4.0 base score 5.1). The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) indicates network reachability, low complexity, no stated privileges, but mandatory active user interaction - a victim (potentially an administrator) must navigate to the poisoned page before the payload fires. Impact is confined to the subsequent system (SC:L/SI:L) with no direct impact on the vulnerable system itself (VC:N/VI:N/VA:N), consistent with script execution in the victim's authenticated browser context rather than direct compromise of the appliance. Exploitation signals are LOW: EPSS is 0.22% (12th percentile), the CVE is NOT on CISA KEV, and no public proof-of-concept is referenced. CONFLICT TO VERIFY: the vendor vector lists PR:N, yet injecting content into the Template Definitions page of an internal management console realistically requires an authenticated account with access to that feature - treat PR:N with caution and verify whether any authentication is needed to plant the payload. Overall this is a genuine but lower-priority issue: a medium-severity, interaction-dependent XSS in a specialized management platform, not a mass-exploitation candidate.

An attacker with access to the Junos Space web UI stores a malicious script tag within a Template Definition. When another user - up to and including an administrator - later opens the Template Definitions page, the script executes in their authenticated session and performs actions (commands) with that victim's permissions. No public exploit code is identified at time of analysis, and successful exploitation hinges on a privileged user viewing the crafted page.