Critical severity · published Oct 9, 2025
CVE-2025-59978
Junos Space: Stored cross-site scripting vulnerability in web application
9.0
CVSS
0.5%
EPSS
No
On KEV
Description
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to store script tags directly in web pages that, when viewed by another user, enable the attacker to execute commands with the target's administrative permissions.
This issue affects all versions of Junos Space before 24.1R4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Junos Space · Juniper Networks
before 24.1R4 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59978
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59978
Vendor Advisory
https://supportportal.juniper.net/JSA103140
More from Junos Space
8.8
CVE-2019-0017
Junos Space: Unrestricted file upload vulnerability
7.5
CVE-2025-59975
Junos Space: Flooding device with inbound API calls leads to WebUI and CLI management access DoS
7.3
CVE-2024-39563
Junos Space: Remote Command Execution (RCE) vulnerability in web application
6.5
CVE-2025-59976
Junos Space: Arbitrary file download vulnerability in web interface
6.5
CVE-2019-0016
Junos Space: Authenticated user able to delete devices without delete device privileges