Junos Space CVE-2025-60009

Exploitation requires the attacker to store a malicious script tag in the CLI Configlet page of Junos Space (a feature used to author device configuration snippets), and then requires a second, higher-privileged user - specifically an administrator - to open that Configlet page so the payload executes in their session. Limiting factors: this is stored cross-site scripting confined to the CLI Configlet feature, so it cannot be triggered without access to author/modify a configlet; mandatory victim interaction (UI:A) is required, meaning an admin must actually view the affected page; and only Junos Space versions before 24.1R4 are affected. Despite the vendor's PR:N rating, injecting into this management page in practice implies prior access to the Junos Space console.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 4.0 base score is 5.1 (Medium), and the vector reflects why it is not higher: although attack vector is network (AV:N) with low complexity (AC:L), exploitation requires victim interaction (UI:A) and yields no direct impact on the vulnerable system (VC:N/VI:N/VA:N) - the impact instead falls on a subsequent system, the victim's authenticated session (SC:L/SI:L). EPSS corroborates low urgency at 0.22% (12th percentile), and there is no CISA KEV listing and no public exploit identified at time of analysis, so this is a latent risk rather than an actively exploited one. The one aggravating factor is the victim population: because the Configlet page is viewed by administrators, a successful injection lets the attacker execute commands with administrator permissions, meaning the real-world impact ceiling is high even though the base metrics rate confidentiality/integrity as Low. CONFLICT TO VERIFY: the vendor vector states PR:N (unauthenticated), yet injecting a stored payload into the CLI Configlet management page of Junos Space realistically implies the attacker already has some authenticated access to the platform - this discrepancy should be confirmed against the Juniper advisory (JSA103140) before treating the flaw as reachable by a fully unauthenticated outsider.

A low-privileged user (or an attacker who has obtained any Junos Space account) saves a malicious script payload into the CLI Configlet page. When an administrator later opens that Configlet page, the stored script executes in the administrator's browser session and issues management actions with administrator permissions. No public exploit code has been identified, and exploitation depends on an admin actually viewing the poisoned page (UI:A).