Medium severity · published Oct 9, 2025
CVE-2025-59982
Junos Space: Dashboard Search field is vulnerable to reflected cross-site script injection
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the dashboard search field that, when visited by another user, enables the attacker to execute commands with the target's permissions, including an administrator.This issue affects all versions of Junos Space before 24.1R4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Junos Space · Juniper Networks
before 24.1R4 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59982
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59982
Vendor Advisory
https://supportportal.juniper.net/JSA103140
More from Junos Space
9.0
CVE-2025-59978
Junos Space: Stored cross-site scripting vulnerability in web application
8.8
CVE-2019-0017
Junos Space: Unrestricted file upload vulnerability
7.5
CVE-2025-59975
Junos Space: Flooding device with inbound API calls leads to WebUI and CLI management access DoS
7.3
CVE-2024-39563
Junos Space: Remote Command Execution (RCE) vulnerability in web application
6.5
CVE-2025-59976
Junos Space: Arbitrary file download vulnerability in web interface