Junos Space: unauthenticated API flood exhausts file handles and locks the management appliance until reboot

CVSS 8.7CVE-2025-59975Firmware, BMC & network fabriccurated

Impact

An unauthenticated attacker who can reach the Junos Space HTTP daemon can flood it with inbound API calls until every file handle is consumed, after which SSH and the web UI both stop answering. For a site that drives its Juniper fabric through Junos Space, that means losing the tool used to push switch configuration and read fabric state exactly when something is going wrong. Recovery is not automatic - the appliance has to be rebooted by hand. The data plane keeps forwarding; what is lost is management and change control.

Who can reach it

Anyone with network reach to the Junos Space HTTP interface, typically anyone on the management VLAN. No authentication and no valid account needed.

What to do

Upgrade to Junos Space 22.2R1 Patch V3 or, on the 23.1 train, 23.1R1 Patch V3; this is an appliance patch and restart, planned as a management-plane outage rather than anything that touches GPU nodes. A system already in this state needs a manual reboot to recover. Until patched, restrict reachability of the Junos Space API to a jump host or management ACL so unauthenticated hosts cannot open connections to it.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-59975 https://supportportal.juniper.net/JSA103172

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.