CVE-2025-59989
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Device Discovery page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4.
Risk Assessment
The organization may experience unauthorized command execution with administrator privileges, potentially leading to full system compromise.
Recommendation
It is recommended to update Junos Space to version 24.1R4 or later, which includes security fixes, and restrict access to the administrative panel.
Other vulnerabilities in Juniper Junos Space
See all- CVE-2014-3412High
Unspecified vulnerability in Juniper Junos Space before version 13.3R1.8 that allows remote attackers to execute arbitrary commands when the firewall is disabled.
- CVE-2025-59999Medium
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the API Access Profiles page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4.
- CVE-2025-59975High
Uncontrolled resource consumption in the HTTP daemon of Juniper Networks Junos Space allows an unauthenticated attacker to flood the system with API calls, leading to denial of service (DoS). After continuous flooding, all file handles are consumed, blocking SSH and web UI access. A manual reboot is required.
Original NVD description (English source)
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Device Discovery page that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS