Product:
Junos Space
Summary
An Improper Neutralization of Input During Web Page Generation vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the input fields in Model Devices. When visited by another user, this enables the attacker to execute commands with the target’s permissions, including an administrator. This issue affects all versions of Junos Space before 24.1R4.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.1 | CVE-2025-59986 |
Exploitation
To exploit this vulnerability, an attacker must inject malicious script tags into input fields of Model Devices within Junos Space. Once the input is submitted, the script will be stored and executed when another user accesses the affected page. This requires user interaction, as the victim must visit the page containing the injected script for the attack to succeed.
Affected Products
- Junos Space: All versions before 24.1R4 are affected by this vulnerability.
Mitigation
To mitigate this vulnerability, users should upgrade to Junos Space version 24.1R4 or later. Additionally, implementing input validation and sanitization measures can help prevent script injection attacks. Regular security assessments and user training on recognizing potential threats are also recommended.